Microsoft Seized the Chinese Phishing Bazaar Behind 1 Billion Scam Texts and Emails Sent Across 150 Countries

That fake toll notice, parcel alert or tax text you got this year probably came off a shelf. On Wednesday, Microsoft and Health-ISAC, a nonprofit that shares threat intelligence across the health sector, moved to dismantle three pieces of a Chinese-language cybercrime marketplace that sold criminals everything they needed to run a scam: accounts, hosting and ready-made phishing kits.

The scale is enormous. Since January, YAM Store, CoGUI and Iron Man together enabled more than one billion malicious messages aimed at more than 75,000 organizations in over 150 countries, Microsoft says. More than 750 million of them targeted Microsoft customers. Consumers, hospitals, banks and ordinary businesses were all on the list, and Microsoft estimates the operators made tens of millions of dollars.

From Japan to a shopfront

The trail started in late 2025, when Japan's National Police Agency alerted Microsoft to scam campaigns hitting people in Japan. Investigators expected to find individual campaigns. Instead they found a sprawling service economy, one that was hard for non-native speakers to penetrate. Japan's Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs joined the work.

YAM Store ran like any online shop. Buyers could browse, compare prices and check out with fraudulent Microsoft and Google accounts or scam tools; Microsoft made controlled purchases to see how it worked. To manufacture accounts, operators bought expired domains that legitimate organizations, often nonprofits and schools, had let lapse, rebuilt the sites to look alive, and used them to obtain Microsoft 365 accounts for resale. They also generated fake companies with AI tools, complete with content and paperwork, abused stolen application credentials and hosted pages on SharePoint and OneDrive.

Plug and play phishing

CoGUI supplied the bait: ready-made websites and messages impersonating companies, banks and government agencies, aimed mostly at the US and Japan. Proofpoint first flagged CoGUI campaigns against Japan in late 2024. By mid-2026, CoGUI was being replaced by Iron Man, which Microsoft says offered more than 2,300 templates impersonating banks, retailers, healthcare providers, transport authorities, police departments and government agencies across more than 150 countries.

The lures will sound familiar: unpaid tolls, traffic fines, delivery problems, account checks. The kits used geofencing, fake CAPTCHA gates and IP filtering to keep security analysts from seeing the pages. Many of the messages aimed at Microsoft customers relied on device-code phishing, which tricks a victim into handing over an authentication token rather than a password. With stolen card data in hand, criminals mostly bought high-end goods or moved money on legitimate financial platforms.

Microsoft stresses that appearing in a template does not mean a brand was compromised. The kits simply copied the logos people trust. The same trick shows up in narrow, targeted campaigns, like the China-linked group that went after AI policy experts. YAM Store and its partners sold it at retail.

The seizure

The action was a civil disruption, not an arrest. Under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting the three services. Microsoft disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 domains used for impersonation and fraud, and says more infrastructure is coming down. It credits AI tools with helping connect accounts, sites and servers that looked unrelated. Microsoft tracks the marketplace as Storm-3119.

Steven Masada, who runs Microsoft's Digital Crimes Unit, described the problem from the victim's side. "These messages are relentless. Delete and block one, and another takes its place. Ignore them, and more will follow. Fall for one, and the floodgates open," he said.

He was also candid that this is one slice of something bigger. "YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on," Masada said.

His last point is the one worth keeping. "The scam message is often the only part victims see. The businesses behind it are what make it possible."

Some offers on this page may be paid placements or contain affiliate links.