Microsoft, Japan's National Police Agency and Health-ISAC disrupt phishing network tied to 1 billion messages

Microsoft says it has knocked out a Chinese-language cybercrime supply chain responsible for more than one billion phishing emails and texts since January 2026. The company announced the operation Wednesday, Oct. 14, alongside Health-ISAC, Japan's National Police Agency (NPA) and a group of private firms.

The targets of the takedown were an underground marketplace called YAM Store and three phishing kits: CoGUI, Haozi and Iron Man.

Microsoft says the messages hit more than 75,000 organizations in over 150 countries. More than 750 million were aimed at Microsoft customers. Operators made "tens of millions of dollars," according to the company and Health-ISAC.

How the operation worked

YAM Store did not send the scam messages itself. It sold the plumbing. Microsoft tracks the marketplace as Storm-3119 and the developers of the three kits as Storm-2990.

Buyers could purchase compromised or fraudulently obtained Microsoft and Google accounts, licenses and storage. Microsoft says the operators took over expired web domains of real organizations, rebuilt their websites to make defunct entities look alive, and then used those identities to get cloud accounts. They also built fake organizations, complete with content and documentation, using AI tools.

Inside compromised Microsoft environments, operators used stolen application credentials to manage accounts and licenses. They abused SharePoint and OneDrive for hosting.

That matters for defenders. Mail filters often give extra trust to senders on Microsoft 365 or Google Workspace infrastructure, and this model was built to exploit that trust.

The kits

CoGUI and Haozi were advertised first. Iron Man followed in June 2026 and, per Microsoft, pushed CoGUI aside by mid-year. Iron Man offered more than 2,300 templates impersonating banks, retailers, delivery services, police departments and other government agencies.

Lures included unpaid tolls, traffic penalties, missed deliveries and account verification requests. The kits supported geofencing, fake CAPTCHA gates and IP filtering to frustrate security analysis.

Microsoft says many campaigns used device-code phishing, which tricks a victim into authorizing a login and hands the attacker an authentication token. That route can sidestep a stolen password entirely.

Resecurity, which took part in the investigation, examined exposed Iron Man infrastructure. It found a publicly exposed Git and container registry with 911 published builds and eight registered accounts. It also found a product-selection subsystem tied to payment-card capture, cataloging 2,360 phishing packages covering 130 countries and areas, with updates through Oct. 1, 2026.

Payments to YAM Store and the affiliated kit sellers were taken in cryptocurrency, including USDT and Ethereum, Microsoft said.

What was seized

Operating under a federal court order, Microsoft and Health-ISAC seized and redirected domains that powered all three platforms. Microsoft says it disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. It says it is continuing to remove infrastructure hosted on its services.

The partners also included Japan's Cybercrime Control Center (JC3), Cloudflare, Oracle, Proofpoint and TRM Labs.

The case began in late 2025, when the NPA alerted Microsoft to malicious messaging campaigns hitting people in Japan. Proofpoint had flagged CoGUI-linked email campaigns "consistently targeting Japan" back in late 2024. Microsoft says the trail led into a Chinese-language ecosystem that was hard for non-native-speaking investigators to penetrate.

Targets spanned healthcare, financial services, wholesale distribution and IT in Japan, the United States, Australia and India.

"What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation," wrote Steven Masada, general counsel and general manager of Microsoft's Digital Crimes Unit, in a company blog post.

Will it last?

Takedowns of this kind have a track record of limited staying power, and at least one analysis of this operation says so directly. Gokhshtein Media's technology desk argues that takedowns "address individual ecosystems, but the underlying economics remain intact." It says the low cost of running phishing campaigns and their high success rate mean threat actors "will rebuild or shift to alternative kits."

The operation's own details give that argument some material to work with. Iron Man was still shipping updates as of Oct. 1, and the kits share capabilities and infrastructure that suggest common code, reuse or close collaboration among their developers, per Microsoft. Seizing domains and closing accounts hurts. It does not, by itself, remove the people who wrote the software.

Open questions

Microsoft has not announced arrests, and it has not named any individual operators behind YAM Store or the kits. Its announcement describes civil and technical action: court-ordered domain seizures, account shutdowns and domain blocking. The NPA has supplied intelligence and investigative support, but no criminal charges tied to this operation have been announced.

That leaves the key question open. If the operators and developers remain free and the underlying code is intact, how quickly does a successor marketplace appear? Microsoft says its blocking of impersonation domains continues.