On October 14, 2026, Microsoft reported that a federal court in Florida had authorized temporary relief used to seize and redirect domains supporting YAM Store, CoGUI and Iron Man. Microsoft’s legal notice also says the company disabled more than 20,000 accounts connected to YAM Store and was blocking more than 100,000 domains used for impersonation and fraud.
A marketplace and two phishing kits
The three services played different roles. Microsoft describes YAM Store as a marketplace for compromised or fraudulently obtained Microsoft and Google environments, accounts and related infrastructure. CoGUI supplied ready-made phishing websites and messages; Iron Man System offered phishing templates. Microsoft’s technical account says Iron Man had more than 2,335 templates tailored to more than 139 countries.
What Microsoft’s figures count
Microsoft said the three components had enabled more than 1 billion malicious messages since January 2026, including more than 750 million geared toward Microsoft customers. That customer-focused figure is part of the broader total. Microsoft also reported that more than 75,000 organizations worldwide had been targeted.
Microsoft traced the investigation to an alert from Japan’s National Police Agency in late 2025 about campaigns targeting Japan. The company said Japan Cybercrime Control Center (JC3) shared intelligence that helped connect incidents and assess their impact on Japanese organizations and customers. JC3 drew on information from a network of more than 130 member organizations.
The case is a civil action
Microsoft Corporation and Health-ISAC, Inc. are the plaintiffs in the case before the U.S. District Court for the Southern District of Florida. The legal notice names Yang Jian, doing business as Yam Store, Inc., and Does 1–10 as defendants. Microsoft alleges unlawful conduct and says the court authorized a temporary restraining order; the case is a civil proceeding.
