Microsoft and the health care security group Health-ISAC have used a U.S. court order to seize web domains behind three services that Microsoft says powered more than 1 billion phishing messages this year, The Record reported Wednesday. The case shows that much of today's phishing is bought off the shelf, from vendors that sell cloud accounts, scam templates and hosting to criminals with little skill of their own.

What Happened

With an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains used by three services: YAM Store, CoGUI and Iron Man, Microsoft's Digital Crimes Unit said in a blog post by Steven Masada, the unit's assistant general counsel. Since January, the company said, the services enabled more than 1 billion malicious messages aimed at over 75,000 organizations, including more than 750 million aimed at Microsoft customers, and generated tens of millions of dollars for their operators.

Microsoft said it has disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. It is still removing infrastructure hosted on its own services. No arrests tied to the three platforms have been reported.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Each service played a different role. YAM Store worked like an online shop selling fraudulent Microsoft and Google accounts and other scam tools; Microsoft said it confirmed this through test purchases. Its operators bought web domains that nonprofits and schools had let lapse, rebuilt the sites to look active, and used them to obtain Microsoft 365 accounts for resale. CoGUI supplied ready-made websites and messages impersonating companies, banks and government agencies. Iron Man offered more than 2,300 reusable templates for email, text and web lures, and by mid-2026 had largely replaced CoGUI, according to Microsoft. Lures included unpaid tolls, failed deliveries and traffic fines.

In a separate technical report, Microsoft Threat Intelligence tracks YAM Store as Storm-3119 and the developers of the CoGUI, Haozi and Iron Man kits as Storm-2990. Microsoft said it assesses "with high confidence" that those developers are Chinese-speaking. It did not identify any individuals.

Why It Matters

For executives, the case is a reminder that a convincing phishing message no longer requires a capable attacker. Account brokers and kit vendors package everything a buyer needs, so campaign volume is limited mainly by how much criminals are willing to spend.

Two techniques deserve attention. First, Microsoft said some downstream buyers abused the device code sign-in flow, a method built for devices such as smart TVs where a user types a short code on another screen. Victims were tricked into completing a genuine sign-in, which handed the attacker a working access token without stealing a password. Second, the resale of lapsed school and nonprofit domains shows that letting an old domain expire can create a fresh, trusted-looking identity for criminals.

Microsoft's report lists health care, financial services, wholesale distribution and IT among the targeted sectors, with Japan, the United States, Australia and India among the targeted countries. Its recommendations include phishing-resistant multifactor authentication for privileged accounts, passwordless sign-in such as passkeys, limiting where users can register sign-in methods, and verifying urgent requests through a separate channel.

Context

The investigation began in late 2025, when Japan's National Police Agency alerted Microsoft to scam campaigns aimed at people in Japan, Microsoft said. Japan's Cybercrime Control Center, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and the U.S. Secret Service also took part. BleepingComputer reported that Resecurity, which gained access to Iron Man's infrastructure, cataloged 2,360 phishing packages covering 130 countries and areas.

Microsoft has used civil court orders against criminal services before. Last month it took down EvilTokens, and The Record noted earlier actions against the RaccoonO365 and RedVDS platforms.

What to Watch

Microsoft says YAM Store, CoGUI and Iron Man are only part of a larger network and that removal work continues. Watch whether the operators reappear on new domains, whether law enforcement in Japan or the United States announces charges, and whether security teams move to restrict device code sign-ins where their staff have no need for them.