Microsoft, partners disrupt phishing kit ecosystem behind cybercrime operations

Microsoft and its partners dismantle three parts of a wide-ranging cybercrime marketplace: YAM Store, CoGUI, and Iron Man

AT A GLANCE

• Microsoft collaborated with Japan's National Police Agency and partners to dismantle a Chinese-language cybercrime marketplace responsible for phishing kits.
• The operation targeted three components of the marketplace: YAM Store, CoGUI, and Iron Man, which collectively enabled over one billion malicious messages aimed at various organizations worldwide.
• The phishing kits allowed criminals to impersonate trusted organizations, making it easier to execute phishing attacks across multiple sectors and countries.

This is AI-generated. Read the article for full context. Report any errors.

MANILA, Philippines – Microsoft worked with Japan’s National Police Agency and a host of partners, including cybersecurity companies and global nonprofit organization Health-ISAC, to dismantle part of the operations of a Chinese-language cybercrime marketplace responsible for creating and selling phishing kits — or accounts, hosting services and tools for building fake websites and online identities.

In an October 14 blog post, Microsoft said it and Health-ISAC dismantled three parts of that marketplace’s infrastructure: YAM Store, CoGUI, and Iron Man.

Steven Masada, general counsel and general manager of Microsoft’s Digital Crimes Unit, said YAM Store, CoGUI and Iron Man have since January 2026 “collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone.”

He added, “These messages have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.”

While YAM Store provided the infrastructure, the phishing kits sold on the marketplace, including CoGUI and Iron Man, provided bad actors with access to ready-made templates allowing them to impersonate trusted organizations. With the templates in hand, criminals could quickly send email, text and web content tailored to specific brands, industries, and countries in an effort to get people to click on phishing links.

Masada explained that the phishing kits allowed for impersonation attempts across a spectrum of organizations, from government agencies to banks, retailers, and parcel delivery services from various countries and in numerous languages.

Masada added, “YAM Store, CoGUI, and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.”

A more technical breakdown of the phishing infrastructure that complements the Microsoft blogpost is available on Microsoft’s security blog. – Rappler.com