On October 14, 2026, Microsoft and the health-sector information-sharing group Health-ISAC announced that they had seized domains underpinning "YAM Store," "CoGUI," and "Iron Man," services that sell accounts and fake-site creation tools used in phishing scams. The investigation began with information provided by Japan's National Police Agency, and these services reportedly enabled the sending of more than 1 billion malicious messages since the start of 2026. Criminals did not have to build fake sites from scratch: they could buy accounts illicitly obtained from legitimate cloud services, along with fake screens tailored to a target's country or organization. The action targets the supply chain of criminal services behind individual scam messages.
The "Wholesale Market" for Scams That Japan's Investigation Uncovered
According to Microsoft's announcement, the investigation began in late 2025, when Japan's National Police Agency provided information about malicious messages aimed at users in Japan. Investigators examined methods that posed as parcel delivery notices or bank account verification requests to steal passwords and payment information, and found that several Chinese-language criminal services were connected.
The Japan Cybercrime Control Center (JC3) also explained that it worked with the National Police Agency and member companies to provide information on domestic damage and specific details. From a victim's perspective, scams impersonating different companies may look entirely separate, but tracing the tools and sellers used revealed commonalities. Damage information consolidated in Japan became a clue for identifying suppliers of criminal services based overseas.
According to Microsoft, since January 2026 these services have enabled the sending of more than 1 billion malicious messages and targeted more than 75,000 organizations. Of these, more than 750 million messages were directed at Microsoft customers. However, these figures represent the scale of malicious messages sent, including email and SMS, and do not mean that the same number of people suffered financial losses.
The seizure and transfer of the domains were carried out by Microsoft and Health-ISAC under an order from the U.S. District Court for the Southern District of Florida. Microsoft has disabled more than 20,000 accounts associated with YAM Store and is also moving to block more than 100,000 domains used for impersonation and fraud. Blocking domains and court-ordered seizure are different measures, however, and the two should not be conflated. The operation combines disabling accounts used by criminals with action against the domains that support the scams.
Selling the Trust and Storage of Legitimate Clouds
What YAM Store sold were illicitly obtained Microsoft and Google cloud environments. According to Microsoft's technical report, buyers could choose products based on an account's usage history and subscription type, and cloud environments belonging to educational institutions and nonprofits were also offered. What was sold was not just an account that could be logged into, but the trust attached to it and the services available through it.
One method of acquiring accounts involves re-registering domains once owned by legitimate organizations that lapsed because they were not renewed. The operators rebuilt websites on the acquired domains, made it look as though the organization were still active, and fraudulently obtained Microsoft 365 accounts. The accounts obtained this way were sold to criminals through YAM Store. Even building websites that feign organizational legitimacy was built into the process of procuring accounts for crime.
Takeovers of existing organizations' cloud environments were also confirmed. In these cases, attackers used stolen application credentials to access administrative functions and manipulate accounts and licenses. Because they can maintain access through application-level authentication without depending on individual users' login sessions, it is difficult to grasp the full picture of unauthorized access by monitoring user accounts alone.
In addition, the operators abused SharePoint and OneDrive storage as repositories for large volumes of content, and resold that storage itself. In other words, YAM Store dealt not only in accounts and licenses but also in cloud storage usable for running scam sites. Behind fake sites impersonating companies and financial institutions lie resources illicitly procured from legitimate cloud services. Examining the scam sites alone does not reveal how attackers obtained the infrastructure they needed.
Fake Sites That Respond to Victims' Input
CoGUI spread mainly targeting Japan and the United States, but by mid-2026 a shift to Iron Man had begun. For criminals, this means services that make it easy to deploy fake sites tailored to a country or corporate brand keep appearing one after another. Security firm Resecurity, which cooperated in the investigation, actually purchased an Iron Man license and tested its behavior in an isolated environment. According to what the company confirmed in its catalog as of October 1, 2026, 2,360 phishing templates covering 130 countries and regions were available. They included screens of delivery companies and banks, as well as those posing as tax or traffic-fine payments, but this is merely a list of impersonation templates and does not indicate that the named organizations were actually breached.
These fake sites also incorporated features that obstruct security research. Microsoft confirmed access controls based on the connecting country or IP address, as well as fake CAPTCHAs requiring human interaction. The mechanism shows scam screens only to targeted users while avoiding access from security researchers and automated crawlers.
Phishing kits such as Iron Man also do more than display screens that imitate legitimate sites. Information entered by victims is collected via WebSocket, and attackers are notified through Telegram. Attackers can monitor victims' input in real time and manually switch the next screen to display. It functions as an interactive scam tool that draws out the necessary information in response to the other party's actions.
Microsoft also observed that in some follow-on attacks associated with these kits, a technique abusing legitimate device code authentication was used. Attackers lead victims to perform an authentication operation on a legitimate app, and as a result obtain an access authentication token. In this case, what the user sees is not necessarily a fake login screen, so it is difficult to judge a scam by appearance alone. Even with a legitimate authentication screen, it is necessary to check who is requesting the authentication and for what purpose.
Three Mechanisms Supporting the Criminal Services
Iron Man is a product that buyers install in their own environments, but it did not operate completely independently of the seller's infrastructure. Resecurity compared communications in the isolated environment with the configuration of the public build, and confirmed that the admin panel requires a continuous connection to a license server operated by the seller. Given this mechanism, the criminal-service supply chain revealed here can be organized into three functions: account procurement, fake-site creation, and authentication for continued use.
| Function supplied | Provider/mechanism confirmed | What disruption can target, and its limits |
|---|---|---|
| Account procurement | YAM Store sold illicit cloud environments, licenses, and storage | Disabling accounts and similar measures can reduce resources available to buyers, but cannot fully prevent a shift to other sources |
| Fake-site creation | CoGUI and Iron Man provided ready-made templates by country and brand | Action against sites and distribution infrastructure can hinder deployment, but rebuilding on other domains must be continually tracked |
| Authentication for continued use | Installed Iron Man kits depend on the seller's authentication infrastructure | Stopping the shared authentication endpoint could affect multiple installations, but it has not been confirmed that this endpoint was stopped |
This table organizes findings published by Microsoft and Resecurity on October 14 by the functions criminals need. Because a single operator may handle multiple functions, it does not mean that criminal organizations are divided into three. The account procurement and sales channels can be confirmed in Microsoft's technical report, and the dependence on license authentication in Section 4 of Resecurity's report.
In Resecurity's testing, Iron Man's admin panel checked its local license status roughly every 20 seconds, and this process triggered queries to the seller's server. This mechanism lets the seller manage recurring billing and usage permissions, but it also means the shared authentication infrastructure could become a target for attack or blocking. If that authentication server could be stopped, it might affect multiple phishing kits that buyers have installed in different environments. The mechanism that makes a criminal service a sustainable business can also be a weak point when disrupting the supply chain as a whole. However, Resecurity's testing was conducted in an isolated environment and did not examine buyers' live environments or victims' systems. While the potential effectiveness of stopping the central authentication infrastructure can be confirmed, it cannot be concluded that all Iron Man installations were rendered unusable by this action.
The Effect Depends on How Long Rebuilding Can Be Delayed
Security firm Proofpoint reports roughly 17,000 distinct domains used since it began tracking CoGUI and two related phishing kits. According to the company, criminals change domains frequently, so even if individual fake sites are blocked, new ones can be launched as long as sources for tools and infrastructure remain. This reality calls for action not only against individual scam sites but against the entire supply chain that supports them.
For users, even when they receive a message urging them to act on a delivery or bank account verification, it is important not to proceed through the links provided and instead to confirm the matter through another route, such as the official app they normally use. Organizations need to pay attention not only to managing privileged accounts but also to permissions granted to applications and to misuse of cloud storage. Microsoft also recommends measures such as adopting passkeys and phishing-resistant multifactor authentication, and minimizing administrator privileges.
The disabling of more than 20,000 accounts and the action against domains are significant in that they address the very resources criminals were selling as products. To judge their effect, however, it will be necessary to keep tracking how the sellers procure new accounts, redeploy fake sites, and migrate their authentication infrastructure. If rebuilding the supply chain can be hindered for a long period, criminals who want to buy the same tools and start new scams will also be forced to spend more time and money on procurement. Whether this action amounts to a temporary disruption or a lasting blow to the operation of the criminal services themselves will become clear from how rebuilding proceeds.