Microsoft has secured a court order in Florida to seize and redirect domains belonging to YAM Store, an underground marketplace that sold compromised Microsoft 365 and Google environments along with the phishing kits built on top of them. The Digital Crimes Unit announced the action on October 14, describing infrastructure tied to more than 1 billion malicious messages since January and attacks on over 75,000 organizations.
The significance lies less in the scale of the spam than in the target: not the individual scammer sending the message, but the supplier selling the tools and ready-made accounts.
- Wholesale access: YAM Store sold fraudulently obtained or compromised Microsoft 365 and Google environments, including .edu and .org domains, through a storefront with sub-resellers, Telegram notifications and payments via Alipay, WeChat Pay and USDT on TRC20.
- Phishing kits: Microsoft names CoGUI, Haozi and Iron Man System, which use geofencing, fake CAPTCHA gates, IP allowlists and blocklists, and real-time Telegram alerts to help attackers evade detection.
- Limited disruption: The order covers domains and more than 20,000 disabled accounts, but no arrests or charges were announced; the operators, who earned tens of millions of dollars, remain at large.
A marketplace built on borrowed reputations
According to Microsoft Threat Intelligence, YAM Store was less a shadowy forum than a commercial operation. It maintained a catalog, a layer of sub-resellers and direct contact with buyers. Its inventory included corporate Microsoft 365 and Google accounts obtained fraudulently or through compromise, with .edu and .org domains among the assets on offer.
The most notable technique was the recycling of expired or previously used organization names. The group located those names automatically and combined them with legitimate customer information to create new environments. The resulting mailboxes began with clean reputations, making them difficult for filters to block because they appeared to come from institutions with respectable histories. Microsoft documented a fictitious charity built on a newly registered .org domain.
Microsoft tracks two actors: Storm-3119, behind the marketplace, and Storm-2990, the kit developers. It attributes kit development to Chinese-speaking actors with high confidence. Shared infrastructure and capabilities suggest a common origin, code reuse or close collaboration.
Phishing kits that watch the victim in real time
These are not static fake pages. Iron Man System, operational since June 2026 and still expanding, carries more than 2,335 impersonation templates spread across more than 139 countries. The kits can display only in targeted countries, present a fake CAPTCHA to filter automated analysis, maintain allowlists and blocklists, and notify the scammer through Telegram when someone takes the bait. More troubling, they hold an open connection that lets an attacker observe the victim live and decide which screen to show next, harvesting credentials, card data and verification codes step by step. In some cases the objective is not the password itself: the victim authenticates to a legitimate service and the attacker walks away with the access token.
The campaign reached more than 150 countries, with Japan and the United States at the top. Healthcare, financial services, wholesale distribution and technology were priority sectors. Of the more than 1 billion messages, over 750 million targeted Microsoft customers. In the US, lures focused on traffic matters, fines and parking fees, while the group impersonated banks, retailers, healthcare providers, transport companies and public agencies, including police.
The investigation began in late 2025, when Japan’s National Police Agency warned Microsoft about campaigns against Japanese citizens. Japan’s cybercrime control center, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, the US Secret Service and other international law enforcement partners also took part.
What the takedown does and does not change
“Disrupt” is doing more work in Microsoft’s announcement than the word “dismantle.” The concrete outcome is seized domains and more than 20,000 disabled accounts. The announcement mentions no arrests or charges. The operators, who according to the company made tens of millions of dollars, are still there.
There is recent precedent. In November 2024, the same unit seized 240 sites belonging to another phishing-kit service. The business did not disappear; it reorganized.
“What looks like a simple scam message is often the visible edge of a much larger transnational cybercriminal operation,” wrote Steven Masada, general manager and associate general counsel of Microsoft’s Digital Crimes Unit. “The businesses behind it are what make it possible.”
The case’s value is in hitting the supplier rather than the individual scammer. That raises costs for thousands of criminals at once instead of closing a single campaign. Its limit is equally clear: while the infrastructure can be rebuilt without criminal consequences for anyone, each strike buys months, not years. The broader lesson for defenders is uncomfortable. If an attacker can manufacture a credible identity by recycling a charity’s expired name, sender reputation is no longer a defense.