Microsoft and Health-ISAC said on October 14, 2026, that they had seized and redirected domains linked to YAM Store, CoGUI and Iron Man under an order from the U.S. District Court for the Southern District of Florida, according to Microsoft. The court docket records that a sealed order was entered on October 7. Cybersecurity Dive reported that the judge granted the request.
Three services with different roles
Microsoft describes the services as parts of a broader Chinese-language cybercrime marketplace. YAM Store sold fraudulent or compromised cloud accounts and infrastructure. CoGUI supplied ready-made websites and messages that impersonated businesses and other trusted organizations. Iron Man offered phishing templates.
Microsoft said Iron Man was increasingly replacing CoGUI by mid-2026, a shift in the services’ relative use. Microsoft and Resecurity also identified more than 2,300 Iron Man templates impersonating organizations in more than 150 countries.
What Microsoft’s figures cover
Microsoft attributed more than 1 billion malicious messages to the three services from January 2026 onward, targeting more than 75,000 organizations in over 150 countries. Of that reported total, more than 750 million messages were geared toward Microsoft customers.
On October 14, Microsoft also said it had disabled more than 20,000 accounts connected to YAM Store. The company said it was continuing to remove infrastructure hosted on its services and block more than 100,000 domains used for impersonation and fraud.
What an Iron Man template does—and doesn’t—establish
An organization’s appearance in an Iron Man template does not mean its systems were compromised, Microsoft said. The template count describes impersonation material associated with organizations across many countries; it is not a count of confirmed breaches.
