By Sofia Ramirez
Publication Date: 2026-10-14 14:41:00
Microsoft said on 14th October, 2026 that it seized domains behind YAM Store, CoGUI and Iron Man, three Chinese-language phishing services, under a U.S. court order. The wider ecosystem has pushed more than 1 billion phishing emails and texts since January.
The Brief
- Microsoft disabled more than 20,000 accounts tied to YAM Store, a market selling compromised or fraudulently obtained Microsoft and Google cloud accounts.
- Japanese police flagged scam texts aimed at people in Japan in early 2025, which started the investigation.
- Resecurity found 2,360 lure templates on Iron Man, copying banks, police and government agencies in 130 countries.
- Microsoft is still blocking more than 100,000 domains used to impersonate trusted brands and agencies.
Microsoft tracks the cluster behind the kits as Storm-2990. Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit, set out the case in a company blog post. More than 750 million of the messages targeted…
