More than 1 billion malicious messages, sent to over 75,000 organizations in 150 countries, are traced to a Chinese-language cybercrime ecosystem that Microsoft and Health-ISAC moved against this month. A federal judge in the Southern District of Florida gave the two groups control of the domains behind it.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Some of the messages were the unpaid-toll and traffic-penalty texts that millions of phone owners have already seen, while others posed as delivery problems and account-verification notices.
Three services behind the messages
Microsoft named three products in the action. According to BleepingComputer’s report, YAM Store, which Microsoft tracks as Storm-3119, is the marketplace that sold compromised or fraudulent Microsoft and Google environments, accounts, licenses and storage. CoGUI and Iron Man System are the phishing kits tracked together as Storm-2990, and Iron Man overtook CoGUI by mid-2026 with more than 2,300 impersonation templates covering banks, retailers, delivery services and government agencies.
The operators bought expired domains of real organizations, rebuilt their websites and used AI tools to generate fake organizations, then abused SharePoint and OneDrive for hosting. BleepingComputer adds that CoGUI mainly targeted the United States and Japan. Microsoft said many campaigns relied on device-code phishing to capture authentication tokens, and the kits shipped with geofencing, fake CAPTCHA gates and IP filtering to dodge scanners.
The court order and the takedown
On October 7, a federal judge in the Southern District of Florida granted Microsoft and Health-ISAC, the health care industry’s information-sharing group, control of the sites’ domain names, Cybersecurity Dive reported. The order cuts the marketplaces off from those domains, at least for now, and the companies announced the operation on October 14, a week after the judge acted. Microsoft deactivated more than 20,000 accounts associated with YAM Store, and over 100,000 impersonation and fraud domains have been blocked, with further infrastructure removal still under way.
Steven Masada, associate general counsel and general manager of Microsoft’s Digital Crimes Unit, said the three marketplaces “collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide.” He added that the takedown “makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.” Microsoft’s own write-up ties the count to activity since January 2026 and says the same kits reached organizations worldwide.
The effort was a coalition. Japan’s National Police Agency started the investigation with Microsoft after a late-2025 tip about scam campaigns aimed at people in Japan, and the partners included the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. TRM said its intelligence was key to locating and enabling the freeze of assets associated with the group, according to its account of the operation, and Microsoft’s figures put the money generated for operators in the tens of millions of dollars.
Scale is the reason the case drew so many partners. Microsoft’s figures, relayed by TRM and BleepingComputer, say that more than 750 million of the messages since the start of 2026 were aimed at Microsoft customers by email and SMS. Health-ISAC supplied data on how the attacks affected health care organizations, and it joined Microsoft in the legal request for the domains. Because the 1 billion count covers every lure the kits supported, toll and traffic-penalty bait is one slice of it, alongside delivery-problem notices and requests to verify an account.
Inside the phishing kits
Proofpoint’s Threat Research Team assessed with high confidence that CoGUI, CoAceV and CoFish_Ws share common roots, and its published analysis says the three kits have used around 17,000 unique domains since tracking began. Most of the 66 impersonated brands it catalogued are Japanese, including PayPay, MyJCB and Rakuten, which fits the Japanese police role in the case. Its data also shows 3,788 unique fully qualified domain names in use between July 1 and September 17, 2026, a pace that makes blocking one lure at a time a losing game for defenders.
Resecurity examined exposed infrastructure and, in its report on Iron Man and YAM Store, counted 2,360 distinct phishing templates targeting 130 countries or areas and 911 published build versions, with the latest template catalog entry dated October 1, 2026. The exposed registry held eight registered accounts, created between October 2025 and June 2026, and Resecurity also found a product-selection subsystem tied to payment-card capture, which suggests the kits were built to harvest card data as well as logins. Catalog growth peaked in May 2026, when 322 templates were added or updated. Templates were being added steadily, which means the kits were sold and maintained as a product.
Microsoft acknowledged that the action will only make a dent in the wider phishing ecosystem, Cybersecurity Dive noted. Resecurity described the operation as dynamic and able to purchase and manage phishing infrastructure at scale, and the October 1 catalog date is a reminder that the operators were still shipping new templates days before the announcement. Whether another storefront picks up the customers is the open question.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
