Microsoft just dismantled three phishing marketplaces — YAM Store, CoGUI, and Iron Man — that Microsoft says were behind 1 billion+ malicious messages since January. Here's what each one sold, how the takedown worked, and why the scam texts on your phone may already be changing.
Triggered by a Times of India report (Tech Desk, Oct 18, 2026). All facts below are attributed to Microsoft's October 14, 2026 blog post (Steven Masada, associate general counsel / GM of the Digital Crimes Unit) and press coverage (Cybersecurity Dive, Healthcare Dive, Rappler, TRM Labs, SQ Magazine). Figures are Microsoft's, not independent findings.
Phishing-as-a-service is crime sold as a subscription: marketplaces like YAM Store, CoGUI, and Iron Man sold ready-made phishing kits, stolen cloud accounts, and bulletproof hosting to criminals who couldn't build them. Microsoft's takedown dismantled three of the biggest — cutting off the supply chain behind more than a billion malicious messages.
Sold fraudulent and compromised Microsoft and Google cloud accounts plus identity-theft tools. These are the raw materials criminals use to send phishing at scale and to look legitimate while doing it. Microsoft disabled 20,000+ accounts tied to the service.
Sold ready-made phishing websites and phishing messages impersonating governments, banks, and tech companies — in multiple languages. A criminal with no technical skill could buy a convincing fake bank login page off the shelf.
Sold thousands of lure templates — researchers at Resecurity found 2,360 of them — impersonating healthcare firms, retailers, police departments, and government agencies in about 130 countries. This is why the same scam text can hit a hospital patient in the US and a bank customer in Japan.
Microsoft says the operators pulled in "tens of millions of dollars". Targets spanned consumers, banks, healthcare networks, financial services, logistics, and IT — predominantly the US and Japan. Microsoft tracks the cluster as Storm-2990.
The key insight: this was a takedown of the supply side — the phishing-as-a-service ecosystem selling the kits, accounts, and templates — not just a batch of individual scam messages.
The phishing texts and emails landing on your phone were very likely built with kits like these. Taking down the factories disrupts the pipeline and raises the cost of rebuilding — but scammers rebrand and rebuild. The templates and techniques will resurface under new names.
Most people overestimate themselves here. Kit-built phishing pages now copy real login screens pixel-for-pixel, so gut feeling is not a defense — only habits are. Answer these 5 questions honestly to find out whether your instincts would survive a professional phishing kit.
1. Before clicking a link in an unexpected message, do you check the sender's actual domain — not just the display name?
2. Do you treat any message that combines urgency ("account suspended", "act now") with a link as suspicious until proven otherwise?
3. For unexpected bank, healthcare, or government messages, do you verify through the organization's official app or website instead of the link in the message?
4. Do you report phishing attempts to your provider or the impersonated organization instead of just deleting them?
5. Do you understand that takedowns disrupt phishing but don't end it — so you stay vigilant even after big wins like this one?
Per Microsoft's October 14, 2026 blog post, they were three Chinese-language phishing-as-a-service marketplaces. YAM Store sold fraudulent and compromised Microsoft and Google cloud accounts plus identity-theft tools. CoGUI sold phishing websites and phishing messages impersonating governments, banks, and tech companies. Iron Man sold thousands of lure templates — researchers at Resecurity found 2,360 — impersonating healthcare firms, retailers, police departments, and government agencies in about 130 countries.
According to Microsoft, since January 2026 the operation sent more than 1 billion malicious messages, targeted over 75,000 organizations, directed 750 million-plus messages at Microsoft customers alone, and reached more than 150 countries. Microsoft says the operators earned tens of millions of dollars. These are Microsoft's figures, reported by the company — not independent findings. The main targets were consumers, banks, healthcare networks, financial services, logistics, and IT, predominantly in the US and Japan.
Through the courts. On October 7, 2026, the U.S. District Court for the Southern District of Florida granted Microsoft and Health-ISAC control of the operation's domain names, allowing seizure and redirection of the malicious infrastructure. Microsoft also disabled more than 20,000 accounts tied to YAM Store and says it is still blocking 100,000-plus impersonation domains. Partners in the action included Health-ISAC, Japan's National Police Agency, TRM Labs, and cybersecurity companies.
No. This was a takedown of the supply side — the marketplaces selling the kits, accounts, and templates — not of every scammer using them. Takedowns disrupt the ecosystem and raise the cost of rebuilding, but criminals routinely rebrand and rebuild. The templates and techniques can resurface under new names. Keep verifying messages and reporting phishing.
Don't click the link. Check the sender's actual domain (not the display name). Treat any message combining urgency with a link as suspicious. Verify unexpected bank, healthcare, or government messages through the organization's official app or website — never through the link in the message. Report the phishing attempt to your provider or the impersonated organization instead of just deleting it.
BreachHunter hunts the infrastructure behind the attacks, not just the messages — so the next phishing factory gets found before it scales.
All 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI
Our platforms are being upgraded and return November 1 — get early access now:
Built by Ingenious AI — facts attributed to Microsoft and press coverage; figures are Microsoft's, not independent findings.