Security Operations

Microsoft seizes phishing kit market behind a billion scam messages

Microsoft and Health-ISAC seize YAM Store, CoGUI and Iron Man domains. What the takedown means for UK defenders facing device code phishing.

Network graphic with the headline Microsoft takes down phishing kit marketplace

Microsoft and Health-ISAC have used a US court order to seize domains behind YAM Store, CoGUI and Iron Man, three linked services that sold scammers stolen cloud accounts and ready-made phishing sites. Microsoft ties the ecosystem to more than a billion malicious messages this year, and the techniques it supported are ones UK security teams deal with every week.

What happened

On 14 October 2026 Microsoft’s Digital Crimes Unit (DCU) announced civil action against a Chinese-language cybercrime marketplace built from three connected services. Working with Health-ISAC, the healthcare information sharing body, Microsoft secured a ruling from the US District Court for the Southern District of Florida. That order let it seize and redirect domains supporting YAM Store, CoGUI and Iron Man.

The numbers Microsoft has published are large. Since January, the services enabled more than one billion malicious emails and text messages aimed at over 75,000 organisations in more than 150 countries, with upwards of 750 million of those directed at Microsoft customers. Microsoft says the operators earned tens of millions of dollars. It has disabled more than 20,000 accounts linked to YAM Store and is blocking over 100,000 impersonation and fraud domains while it strips remaining infrastructure from its own platforms.

The investigation started when Japan’s National Police Agency alerted Microsoft to messaging campaigns aimed at people in Japan. Tracing those campaigns led investigators to a wider marketplace rather than a handful of isolated crews. Intelligence was supplied by Japan’s JC3 cybercrime centre and by Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, with the US Secret Service also involved. TRM Labs says its intelligence helped locate assets linked to the group so they could be frozen.

The technical picture

The three services covered different parts of the fraud supply chain. Microsoft tracks the wider cluster of phishing kits as Storm-2990.

  • YAM Store was an initial access marketplace. Buyers could shop for fraudulent or compromised Microsoft and Google accounts, filtering by account age, subscription type and environment, including education and non-profit tenants. According to Microsoft, operators also bought domains that real organisations had let lapse, rebuilt the websites so the organisations looked active, and turned them into a source of Microsoft 365 accounts to sell.
  • CoGUI supplied turnkey phishing sites and messages imitating banks, brands and government bodies. Criminals began switching from it to Iron Man around mid-2026.
  • Iron Man is a subscription phishing kit. Resecurity bought a licence, ran the kit in an isolated lab and catalogued 2,360 lure templates covering 130 countries and regions, with additions as recent as 1 October. Courier and postal lures were the biggest category, followed by tax authorities and banks. Parking and traffic fine notices also feature, and Resecurity’s lab panel showed a lure for a European parking-fine operator.

Two details stand out for defenders. First, Microsoft says the kits were used not only to harvest passwords and card data but to abuse the OAuth device code sign-in flow, tricking users into authorising an attacker’s session and handing over tokens. That technique sidesteps a password prompt entirely and can defeat MFA that is not phishing-resistant. Second, Resecurity found Iron Man deployments check in with a vendor licensing server roughly every twenty seconds and fail without it, so removing that host degrades every buyer’s deployment at once: an ideal choke point for a takedown.

Flow diagram showing how YAM Store, CoGUI and Iron Man fed a phishing supply chain from stolen accounts to account takeover

Why it matters for UK organisations

None of the sources names specific UK victims, and the reporting says activity was concentrated on the United States and Japan. That does not make this a foreign story. The lure themes Iron Man industrialised, a parcel that cannot be delivered, an unpaid toll or parking charge, a tax refund, a bank account that needs checking, are exactly the themes that dominate smishing reported by the public and staff in the UK. A kit catalogue spanning 130 countries is built to be pointed wherever buyers see money.

The business risk is sharper still. Most UK organisations run on Microsoft 365, and both stolen tenant accounts and device code phishing are routes to mailbox access, internal phishing and invoice fraud. Aged accounts bought from a marketplace like YAM Store can carry a clean sending reputation that helps phishing slip past filters. Expired domains are a related problem: if your organisation, or a charity or school you work with, has let an old domain lapse, someone may rebuild it as a convincing front.

NHS trusts, GP federations and private providers should take note too. Health-ISAC was a party to the case, Microsoft says healthcare was among the sectors targeted, and Resecurity counted healthcare providers among the brands the templates impersonated.

Expert view

Takedowns like this are welcome, but I would treat them as a pause rather than a cure. Resecurity’s own assessment is that the operators control several domain families and could rotate them, and in my experience demand for phishing services tends to shift to the next provider. What the case does show is the economics: the scam text is the cheap end of a supply chain selling accounts, templates and hosting.

In my experience, the weak point is rarely the email gateway; it is the identity layer behind it. When we test Microsoft 365 tenants, device code flow is frequently left enabled for every user despite almost nobody needing it, and conditional access often stops at “MFA required” without asking whether that MFA can be phished. The framing from Microsoft’s Steven Masada, that the scam message is often the only part victims see, is a fair reminder that SOC teams should be hunting for the downstream signs: odd device registrations, token use from unexpected locations and new inbox rules, not just counting blocked emails.

What to do now

  1. Restrict device code flow. Use Entra ID conditional access to block the device code authentication flow for everyone except named accounts with a genuine need, such as meeting room devices. This maps to Cyber Essentials user access control.
  2. Move privileged and high-risk users to phishing-resistant MFA. FIDO2 keys, passkeys or Windows Hello for Business resist both credential harvesting pages and token relay far better than SMS codes or push approvals.
  3. Hunt for token abuse. Review sign-in logs for device code authentications, unfamiliar device registrations and sessions from unexpected networks, then revoke sessions and reset credentials where anything looks wrong.
  4. Audit your domain estate. Keep renewing domains you no longer use, or at least publish SPF, DKIM and DMARC records that reject mail from them. Watch for lookalike registrations of your brand.
  5. Tune detection for lure themes. Make sure filtering and awareness training cover parcel, fine, tax and bank pretexts, and remind staff to forward suspicious emails to report@phishing.gov.uk and texts to 7726.
  6. Check third-party tenants. Treat mail from education and non-profit Microsoft 365 tenants with the same scrutiny as any other sender; a reputable-looking tenant may have been bought.

Bottom line

Microsoft and its partners have taken a real slice out of a phishing supply chain that sold stolen accounts and polished lure kits at scale. The service will be rebuilt somewhere, so UK defenders should use the moment to close the identity gaps it exploited, starting with device code flow and phishable MFA.

Sources

Related Posts