Microsoft and Health-ISAC announce YAM Store domain seizure

On October 14, 2026, Microsoft and Health-ISAC announced that they had seized and redirected domains associated with YAM Store, CoGUI and Iron Man. Microsoft also said it had disabled more than 20,000 YAM Store-linked accounts and was blocking more than 100,000 domains used for impersonation and fraud.

Microsoft described the three services as part of a wider cybercrime network. Its announcement focused on disrupting the infrastructure behind the services, which played different roles in phishing campaigns.

What YAM Store, CoGUI and Iron Man did

Microsoft described YAM Store as a marketplace selling fraudulent Microsoft and Google accounts and tools used in scams, including credential theft. CoGUI supplied ready-made websites and messages impersonating companies, financial institutions and government agencies. Microsoft said CoGUI was used especially against victims in Japan and the United States.

Iron Man offered templates for impersonating organizations. A phishing kit packages tools and content that let operators set up campaigns; Microsoft said Iron Man was increasingly replacing CoGUI by mid-2026.

Microsoft said Japan’s National Police Agency alerted it to scam and fraud messages targeting people in Japan in late 2025, prompting the investigation. Japan’s Cybercrime Control Center also contributed intelligence about activity affecting Japanese organizations and consumers.

Who the Florida civil case names

The case, No. 1:26-cv-26998-JEM, is in the U.S. District Court for the Southern District of Florida. Microsoft Corporation and Health-ISAC, Inc. are the plaintiffs. The case notice names Yang Jian, doing business as Yam Store, Inc., and Does 1–10 as defendants.

Microsoft said it had obtained a temporary restraining order, or TRO, and its case notice describes the relief it requested. The court docket lists a sealed order as Document 20, entered October 7, 2026. Microsoft and Health-ISAC announced the domain disruption on October 14.

What the reported numbers cover

Microsoft estimated that the three services enabled more than 1 billion malicious messages targeting over 75,000 organizations in more than 150 countries since January 2026. The company said more than 750 million of those messages were geared toward Microsoft customers. These are Microsoft’s estimates of the services’ activity.

Microsoft also reported disabling more than 20,000 accounts connected to YAM Store and blocking or working to block more than 100,000 domains used for impersonation and fraud. The account count and domain count describe separate measures in the announced operation.

Resecurity’s technical snapshot predates the announcement

In an analysis published October 14, Resecurity counted 2,360 Iron Man templates across 130 target areas and 911 published image versions in an associated registry. Its catalog contained entries dated through October 1, 2026. Resecurity described using a purchased license, an isolated lab deployment, traffic capture and a review of registry listings. Those dated observations describe activity before Microsoft’s public announcement.

A template naming an organization is not evidence that the organization’s systems were compromised, Microsoft said. Microsoft also described YAM Store, CoGUI and Iron Man as part of a wider criminal network.