The short version
The takedown removes a major supplier of phishing infrastructure, not phishing itself. On October 14, 2026 Microsoft announced it had disrupted YAM Store and the CoGUI, Haozi and Iron Man kits, which sent over one billion messages to 75,000+ organizations since January. Their edge was looking legitimate — real-seeming tenants and domains — so identity controls in your cloud and DevOps setup matter more than spam filters.
What did Microsoft take down?
YAM Store worked like an online shop for scammers. Instead of sending phishing itself, it sold what a campaign needs to look trustworthy: Microsoft and Google accounts, licenses and cloud storage that were either hijacked or created under false identities, plus web domains. Microsoft tracks the marketplace as Storm-3119. Alongside it ran three phishing-as-a-service kits — CoGUI, Haozi and its successor Iron Man — used by Chinese-speaking operators Microsoft calls Storm-2990.
Acting under an order from the US District Court for the Southern District of Florida, Microsoft seized and redirected domains, disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 domains used for impersonation. The investigation started after Japan's National Police Agency flagged a wave of fraud hitting Japanese people and businesses. “Delete and block one, and another takes its place,” Microsoft's Steven Masada said, which is a fair warning about how long the effect will last.
How did the kits get past filters?
The common thread is borrowed trust. BleepingComputer reports that operators bought expired domains of real organizations and rebuilt websites on them, generated fake companies with AI-made paperwork to register cloud tenants, and hosted phishing pages on stolen SharePoint and OneDrive storage. Mail from a long-lived domain or a genuine Microsoft 365 tenant passes reputation checks that a fresh lookalike domain would fail.
The kits also hid from defenders. Iron Man offered more than 2,300 templates impersonating banks, retailers, delivery firms and government agencies, with geofencing, fake CAPTCHA pages and IP filtering so that security scanners saw nothing suspicious. Some campaigns used device-code phishing: the victim enters a code on a real Microsoft sign-in page, and the attacker receives a valid token without ever touching the password, which also sidesteps basic MFA.
Who was targeted?
Microsoft says more than 750 million of the messages were aimed at its customers and that the campaigns impersonated banks, retailers, healthcare providers, transport authorities and government agencies. CyberScoop reports the heaviest focus on the United States and Japan, with healthcare, financial services, logistics and IT among the hardest-hit sectors. Health-ISAC's role in the case reflects how much of the activity touched hospitals and patients.
Non-profits and education organizations were singled out for a different reason: their tenants, often on discounted or education licenses, were attractive to hijack and resell. A dormant school or charity tenant is a ready-made, reputable sender.
What it means for US & EU teams
For companies that build or run software, the lesson is that sender reputation is no longer a reliable signal. A message from a real Microsoft tenant or a ten-year-old domain can still be hostile. Defense has to move to identity: who is allowed to sign in, with which method, from where, and what a granted token can reach.
Device-code flow deserves specific attention. It exists for TVs, CLIs and IoT devices, yet in many tenants it is enabled for every user. Restricting it through conditional access to the few accounts and devices that need it removes an entire attack path. The same goes for legacy authentication and broad OAuth app consent.
Domain lifecycle is the quiet risk. Marketing microsites, old product names and acquired brands often lapse unnoticed. Once resold, they keep their search history, backlinks and sometimes inbound mail — perfect for impersonating you to your own customers. For firms under GDPR, NIS2 or HIPAA, a successful phish that leads to account takeover is also a reportable incident, so the cost of a missed renewal can be far larger than the fee.
What to do this week
- Restrict device-code sign-in. Block the device code flow in conditional access except for named service accounts and kiosk devices.
- Harden admin sign-in. Require phishing-resistant MFA (FIDO2 keys or passkeys) for privileged roles and review OAuth app consent settings.
- Audit your domains. List every domain the company has registered, including old campaigns and acquired brands, and renew or park the ones that still carry reputation.
- Watch for lookalikes. Monitor new registrations that resemble your brand and enforce DMARC at
p=rejecton all domains, including ones that never send mail. - Test the people side. Run a phishing simulation that uses device-code and cloud-storage lures, not only classic fake login pages.
Frequently asked questions
What was YAM Store?
YAM Store was an underground marketplace that Microsoft tracks as Storm-3119. It did not run phishing campaigns itself; it sold the ingredients for them: fraudulent or hijacked Microsoft and Google accounts, licenses and cloud storage, plus domains, including expired domains that once belonged to real organizations. Microsoft announced its disruption on October 14, 2026.
What are CoGUI, Haozi and Iron Man?
They are phishing-as-a-service kits sold through YAM Store and used by operators Microsoft tracks as Storm-2990. The kits supplied ready-made fake websites and messages; Iron Man alone offered more than 2,300 templates impersonating banks, retailers, delivery services and government agencies, with geofencing, fake CAPTCHA gates and IP filtering to hide from scanners.
How big was the operation?
According to Microsoft, YAM Store, CoGUI and Iron Man enabled more than one billion malicious emails and text messages since January 2026, aimed at more than 75,000 organizations in over 150 countries. More than 750 million of those messages targeted Microsoft customers, and the operation generated tens of millions of dollars for its operators.
What did the takedown actually do?
Under an order from the US District Court for the Southern District of Florida, Microsoft seized and redirected domains, disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. Partners included Japan's National Police Agency, JC3, Health-ISAC, Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs.
Does the takedown mean the phishing will stop?
No. Microsoft itself says that when one service is deleted, another takes its place. The disruption raises the cost of obtaining trusted-looking accounts and domains, but similar kits and resellers remain. Companies should treat it as a window to fix the weaknesses these kits exploit, such as device-code sign-in abuse and lapsed domains.
Sources
Microsoft On the Issues — Disrupting the service economy behind transnational cybercrime operations (October 14, 2026)
BleepingComputer — Global takedown hits network behind 1 billion phishing messages (October 14, 2026)
CyberScoop — Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem (October 14, 2026)