Microsoft says it and the non-profit Health-ISAC are moving to dismantle three parts of a Chinese-language cybercrime marketplace: YAM Store, which sold fraudulent accounts and scam tools, and two phishing kits, CoGUI and Iron Man. Microsoft announced it on Oct. 14, and The Verge covered it.
Microsoft says that since January the three enabled more than one billion malicious messages aimed at more than 75,000 organizations in over 150 countries, including more than 750 million at Microsoft customers, and made "tens of millions of dollars" for their operators. Its Threat Intelligence team says the messages were emails and texts.
What Microsoft says YAM Store sold
Microsoft says buyers could browse YAM Store like a shop and buy fraudulent Microsoft and Google accounts and ready-made scam tools. Some operators acquired internet domains that non-profits and schools had let expire, rebuilt their websites, and used them to obtain Microsoft 365 accounts to sell.
Microsoft says the probe began in late 2025, when Japan's National Police Agency flagged scam campaigns in Japan. It names the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs as contributors, and says it shared intelligence with the U.S. Secret Service.
Why fake toll and package texts look alike
Microsoft says Iron Man gave criminals more than 2,300 ready-made templates imitating banks, retailers, transport authorities, police and government agencies, so they could deploy email, text and web content for a chosen brand, industry and country. Microsoft's threat post says most U.S. lures it saw were transportation or government-related.
Its threat post puts the count at more than 2,335 templates tailored to more than 139 countries. It describes the kits as paid subscriptions that lower the barrier for less skilled criminals, running campaigns "whether it is a missing toll payment or a traffic citation."
A brand in a template was not necessarily breached. Microsoft says the presence of an organization or government entity in these templates "does not indicate that its systems were compromised."
What the takedown covers, and what it does not
Microsoft says that under an order from the U.S. District Court for the Southern District of Florida, it and Health-ISAC seized and redirected domains behind all three platforms. It says it has disabled more than 20,000 YAM Store accounts, a figure The Verge repeats, and is blocking more than 100,000 domains used for impersonation and fraud.
Microsoft has posted the court papers. Its notice of pleadings names "Yang Jian d/b/a Yam Store, Inc., and Does 1-10" as defendants, says Microsoft obtained a temporary restraining order, and says it seeks a preliminary injunction. These are Microsoft's allegations, not findings.
Microsoft is open about the limits. It calls the three only part of a larger criminal network, and says CoGUI was already being replaced by Iron Man by mid-2026. Its threat post says the ecosystem extends beyond Microsoft's services and names a third kit, Haozi. Neither post reports arrests or estimates how much scam traffic will fall.
A short checklist
- Do not tap links in unexpected texts. The FTC says that if an unexpected text asks for personal or financial information, do not click any links.
- Go to the real site or app yourself. CISA says to look up another way to contact the company. Microsoft's threat post says urgency and time pressure were the red flags in nearly all the lures it observed.
- Report the text. The FTC says to forward it to 7726 (SPAM), report it in your messaging app, or report it at ReportFraud.ftc.gov.
- Use passkeys and multi-factor authentication. Microsoft's threat post recommends passkeys and MFA, written for organizations. CISA says MFA helps keep others out of your accounts.
Why it matters
Our read: a scam text is the visible end of a supply chain, and Microsoft's case is that hitting suppliers beats deleting messages one by one. The trade-off is that three named suppliers are not the whole market, so the habits above still matter.
For phone-side defenses, see our checklist of Android's new scam protections and how to spot a fake Chrome app.
