Inside the phishing marketplace behind a billion malicious messages

TL;DR

On 14 October 2026, Microsoft and Health-ISAC announced action against YAM Store, CoGUI and Iron Man. Microsoft says the linked services enabled more than one billion malicious messages since January. The case shows how criminals can buy the accounts, infrastructure and templates needed to run phishing campaigns.

Key details

According to Microsoft's account of the disruption:

• The activity targeted more than 75,000 organisations. Over 750 million messages targeted Microsoft customers. These are targeting figures, not a count of confirmed breaches.
• The investigation began in late 2025 after a tip from Japan's National Police Agency. Partners used AI tools to connect apparently separate accounts, websites and infrastructure.
• Iron Man offered more than 2,300 impersonation templates covering over 150 countries. A brand appearing in a template does not mean its systems were compromised.
• A US court order enabled domain seizures and redirection. Microsoft also reported disabling more than 20,000 accounts linked to YAM Store.

Microsoft's technical analysis describes YAM Store as an initial access broker selling compromised or fraudulently obtained cloud infrastructure. It identifies CoGUI, Haozi and Iron Man System as related phishing kits, with evasion features including location restrictions, IP filtering and fake CAPTCHA gates.

What businesses can do

Microsoft's technical guidance recommends several layers of defence:

• Use passkeys and phishing-resistant MFA, particularly for privileged accounts. Review registration and Conditional Access policies as well as everyday sign-in.
• Restrict administrator privileges and review who can access cloud resources.
• Review email protection settings. For Microsoft Defender for Office 365, check that Safe Links policies cover internal recipients too.
• Teach staff to verify unexpected requests through a separately obtained contact route, even when the message uses familiar branding.

Our take

We see a practical lesson for anyone sending customer messages. Give recipients a way to verify the request without trusting the message itself. A customer should be able to open your app or visit your usual website independently and find the same task there.

A takedown disrupts criminal suppliers. Clear verification paths help your customers when the next convincing message arrives.