Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) announced on October 14, 2026, that they disrupted a cybercrime network responsible for more than 1 billion malicious messages sent since January 2026, according to Microsoft’s own announcement. The takedown targeted three criminal services, YAM Store, CoGUI, and Iron Man, that together ran what researchers describe as a phishing-as-a-service supply chain feeding fraud campaigns to criminal groups around the world.
The scale is what makes this takedown stand out. The Verge reported that the network’s output reached over 75,000 organizations worldwide, and more than 750 million of the billion-plus messages targeted Microsoft customers directly. Acting under an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains tied to the operation’s infrastructure, disabled over 20,000 accounts connected to YAM Store, and blocked more than 100,000 web domains used for impersonation and fraud.
Inside YAM Store, CoGUI, and Iron Man: What Microsoft Says It Shut Down
The three named services functioned less like a single gang and more like a marketplace. YAM Store supplied compromised accounts and credentials. CoGUI and Iron Man reportedly provided the tooling and delivery infrastructure that let buyers send scam messages at industrial scale, impersonating shipping carriers, government agencies, and well-known brands to trick recipients into handing over payment details or login credentials. Microsoft’s announcement frames the three as interlocking pieces of a broader criminal economy rather than an isolated operation, which is why the company disabled accounts and seized domains across all three rather than pursuing a single target.
Microsoft has not published the full technical architecture of the services, and nothing in the public record confirms exactly how the three services divided labor beyond what the company has described in general terms. What is confirmed is the legal mechanism: a federal court order authorized Microsoft and Health-ISAC to seize the domains these services depended on, cutting off the infrastructure rather than waiting for a criminal prosecution to work through the courts.
The Numbers: 1 Billion Messages, 75,000 Organizations
The headline figure, over 1 billion malicious messages since January 2026, covers roughly nine months of activity attributed to the three services. That volume, spread across more than 75,000 targeted organizations, points to an operation built for scale rather than bespoke targeting. The fact that over 750 million of those messages specifically targeted Microsoft customers suggests the network treated Microsoft 365 and Outlook users as a primary audience, likely because of how widely those platforms are used across businesses worldwide.
Microsoft’s response matched the scale of the problem. Disabling over 20,000 accounts tied to YAM Store removes a large chunk of the credential pipeline the network relied on, while blocking more than 100,000 web domains used for impersonation and fraud cuts off the landing pages victims would have been redirected to. Neither figure tells us how much money victims lost or how many people clicked through to a fraudulent page, since Microsoft’s public disclosure does not include those details.
| Metric | Figure | Source |
|---|---|---|
| Malicious messages sent since January 2026 | 1 billion+ | Microsoft / Health-ISAC |
| Organizations targeted worldwide | 75,000+ | The Verge |
| Messages targeting Microsoft customers | 750 million+ | The Verge |
| Accounts disabled (YAM Store) | 20,000+ | Microsoft |
| Fraud/impersonation domains blocked | 100,000+ | Microsoft |
| Named services dismantled | 3 (YAM Store, CoGUI, Iron Man) | Microsoft |
How the Takedown Happened: A Florida Court Order and Domain Seizures
Microsoft’s Digital Crimes Unit has long favored civil litigation as a tool against cybercrime infrastructure, and this takedown followed that pattern. Rather than relying solely on a criminal indictment, Microsoft and Health-ISAC obtained an order from the United States District Court for the Southern District of Florida that authorized them to seize and redirect domains connected to YAM Store, CoGUI, and Iron Man. That legal mechanism lets a private company, working with a nonprofit information-sharing group, cut off infrastructure quickly instead of waiting years for a criminal case to conclude.
Health-ISAC’s involvement is notable because the organization primarily serves the healthcare sector, pooling threat intelligence among hospitals, insurers, and health technology companies. Its participation signals that the scam network’s targets extended into healthcare-adjacent organizations, even though Microsoft’s public disclosure does not break down victims by industry. Readers tracking similar enterprise security patches should also note Microsoft’s record 1,413-CVE Patch Tuesday from earlier this month, which underscores how much of Microsoft’s current security workload runs on parallel tracks: patching software flaws on one side and dismantling criminal infrastructure that exploits users rather than code on the other.
Japan’s Role: National Police Agency Cooperation
The Japan National Police Agency’s involvement gave this takedown its international dimension. According to Microsoft’s announcement, the operation followed cooperation and information-sharing with Japanese law enforcement, though the formal domain seizure itself was executed by Microsoft and Health-ISAC under the Florida court order. ASCII.jp reported that the case originated from a tip tied to Japanese policing efforts, which lines up with Japan’s broader push this year to tighten cyber defenses across its corporate sector, a push covered in detail in our report on Japan’s new law ordering 1,000 firms to harden cyber defenses.
What remains unconfirmed is how much of the 1 billion message total specifically hit Japanese targets, or whether Japanese victims made up a disproportionate share of the network’s activity. Microsoft’s own statement does not break out a country-by-country figure, so any claim along those lines should be treated as speculation rather than fact until a named source confirms it.
Expert Reaction: Microsoft’s Digital Crimes Unit Speaks
Steven Masada, General Counsel and General Manager of Microsoft’s Digital Crimes Unit, framed the three services as pieces of a larger puzzle rather than the whole problem. “YAM Store, CoGUI, and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” Masada said, according to Microsoft’s official announcement.
That framing matters for how businesses should read this news. Masada is not claiming victory over the underlying criminal economy, only over a specific set of services that supplied it. The language echoes a pattern seen across other recent account-security incidents, including the 28-million-account Discord bot token breach, where disrupting one piece of exposed infrastructure reduced risk without eliminating the broader threat actors who exploit stolen credentials across multiple platforms.
Why Phishing-as-a-Service Is Becoming an Industry
CSO Online’s coverage frames this case as evidence that phishing-as-a-service has shifted from a cottage industry of lone operators to something closer to an assembly line, where one group sells credentials, another sells delivery infrastructure, and a third handles the actual message campaigns. That division of labor is exactly what Microsoft’s description of YAM Store, CoGUI, and Iron Man suggests, even though the company has not published a detailed breakdown of each service’s specific role.
This industrialization echoes a broader trend security teams have flagged throughout 2026: criminal groups increasingly behave like software vendors, with tiered pricing, customer support for buyers, and modular tools that let low-skill criminals run sophisticated campaigns. It is a dynamic our coverage of the Warlock ransomware campaign exploiting a SharePoint vulnerability also touched on, where attackers leaned on prepackaged exploitation tooling rather than building custom malware from scratch.
Historical Context: Microsoft’s Long War on Cybercrime Infrastructure
Microsoft’s Digital Crimes Unit has pursued civil takedowns against botnets, phishing kits, and credential markets for more than a decade, using the same legal playbook seen here: obtain a court order, seize or redirect domains, and work with industry partners to disable accounts tied to the infrastructure. This approach treats cybercrime disruption as a legal and technical problem that can move faster than a criminal prosecution, even if it does not result in arrests or convictions on its own.
The involvement of a sector-specific group like Health-ISAC also reflects a broader shift toward information-sharing partnerships as a cybercrime-fighting tool. Rather than Microsoft acting alone, these takedowns increasingly pair a large platform operator with an industry nonprofit that can vouch for the scope of harm across its membership. That model has shown up elsewhere this year too, including the coordination described in the FBI’s arrest of a ShinyHunters suspect tied to a 3TB employee data hack, where law enforcement and private security researchers worked in parallel rather than Microsoft or the FBI acting in isolation.
Market Impact: What This Means for Microsoft 365 and Outlook Users
For the roughly 750 million messages that specifically targeted Microsoft customers, the immediate practical effect of this takedown is a reduction in the volume of scam traffic flowing through the seized infrastructure. That does not mean phishing attempts against Microsoft 365 and Outlook users stop entirely. Criminal operators who relied on YAM Store, CoGUI, or Iron Man will likely look for replacement infrastructure, whether that means standing up new domains, migrating to different criminal marketplaces, or rebuilding similar services under new names.
Enterprise security teams should treat this takedown as a temporary dip in a specific attack surface rather than a resolved threat. The same logic applies to the broader credential-theft economy covered in our look at Cisco and SonicWall zero-days landing on CISA’s Known Exploited Vulnerabilities list, where disrupting one exploited flaw does not stop attackers from pivoting to the next unpatched system. Businesses that rely heavily on Microsoft 365 should expect scam volume tied to these specific services to drop in the near term, while remaining alert for new infrastructure filling the gap.
Competitive Landscape: How Other Tech Giants Fight Scam Networks
Microsoft is not the only large technology company pursuing civil legal action against scam infrastructure. Google, Meta, and other platform operators have pursued similar court-authorized takedowns against fraud networks in recent years, typically using the same core strategy of seizing domains and disabling accounts rather than waiting for criminal prosecutions. The specific tactics, targets, and scale of those actions vary by case and by company, and no single comparison table of results exists publicly across platforms, since each company reports what it dismantled on its own timeline and in its own terms.
What sets this Microsoft and Health-ISAC action apart is the explicit cross-border law enforcement cooperation with Japan’s National Police Agency, layered on top of a US federal court order. That combination of a sector-specific information-sharing group, an international police agency, and a US court gives this takedown a broader institutional footprint than a purely internal corporate security response.
| Party | Role in the Takedown |
|---|---|
| Microsoft (Digital Crimes Unit) | Led legal action, disabled accounts, blocked domains |
| Health-ISAC | Co-petitioner, healthcare-sector threat intelligence partner |
| U.S. District Court, Southern District of Florida | Issued the order authorizing domain seizure and redirection |
| Japan National Police Agency | Cooperation and information-sharing that informed the case |
What’s Still Unknown: Financial Losses and Attribution Questions
Several details that would normally accompany a takedown of this size remain unconfirmed. Microsoft’s public disclosure does not include a dollar estimate of financial losses tied to the network’s activity, nor a confirmed victim count beyond the 75,000-organization figure. The technical specifications of how YAM Store, CoGUI, and Iron Man actually operated, including their infrastructure providers, payment methods, and customer base, have also not been detailed publicly.
Secondary reporting has floated the idea that the network traces back to Chinese-speaking criminal groups, but that characterization does not appear in Microsoft’s own announcement and should not be treated as confirmed. Readers should wait for a named law enforcement source or a court filing with specific attribution before accepting that claim as fact. The same caution applies to any specific individual’s identity, title, or legal status connected to the case. No source currently available identifies a named defendant or confirms any arrest, charge, or conviction tied to this takedown.
Analysis: Legal Takedowns vs. Technical Takedowns
It helps to separate what Microsoft actually did from what people might assume it did. This was not primarily a technical hack-back operation against criminal servers. It was a legal action, a civil court order that gave Microsoft and Health-ISAC the authority to seize domains and compel registrars to redirect traffic away from the criminal infrastructure. The account disabling and domain blocking that followed were the technical execution of that legal authority, not an independent security exploit against the criminals’ systems.
That distinction matters because it shapes how durable the disruption will be. A purely technical takedown, like patching a vulnerability, can be undone the moment attackers find a workaround. A legal takedown backed by a federal court order removes the specific domains and accounts named in the case, but it does not prevent the same operators from registering new domains under new names, assuming they were not identified and are not facing separate criminal charges. Microsoft’s own framing through Masada acknowledges this limitation directly, describing the three services as “only part of that larger criminal network.”
Predictions: What Happens Next in the Phishing-as-a-Service Fight
- Expect replacement infrastructure. Criminal groups that relied on YAM Store, CoGUI, or Iron Man will likely migrate to alternative marketplaces or stand up rebranded services within weeks rather than abandoning the business model.
- More joint takedowns with international police agencies are likely. The cooperation pattern with Japan’s National Police Agency gives Microsoft a template it will probably repeat with other countries facing similar scam campaigns.
- Sector-specific ISACs will keep playing a larger role. Health-ISAC’s involvement here suggests other information-sharing groups, in finance or retail, may co-file similar actions against infrastructure that targets their members.
- Expect continued silence on financial loss figures. Companies pursuing civil takedowns rarely disclose victim-level financial damages, since doing so can complicate ongoing litigation or expose liability questions.
- Regulatory attention on phishing-as-a-service marketplaces will likely grow. As CSO Online’s framing of this case as an “industrial” phishing economy spreads, expect lawmakers in the US, EU, and Japan to cite cases like this one when pushing for stronger platform accountability rules.
What Businesses and Users Should Do Now
Organizations using Microsoft 365 or Outlook should treat this news as a reminder to double-check phishing defenses rather than a signal that the threat has passed. Multi-factor authentication, conditional access policies, and user training on impersonation tactics remain the most direct defenses against the kind of mass messaging campaigns this network ran. Security teams tracking credential-theft infrastructure should also keep an eye on account hygiene practices similar to those recommended after the Discord bot token exposure, since stolen credentials from one platform frequently get recycled into phishing campaigns on another.
IT administrators should also watch for Microsoft’s follow-up guidance, since companies that lead civil takedowns of this size often publish indicators of compromise or blocklists in the weeks after the initial announcement. Until then, the safest approach is to assume that some scam traffic tied to this network is still active under new domains, even as the specific infrastructure named in the court order goes dark.
Frequently Asked Questions
What did Microsoft and Japan actually take down?
Microsoft and Health-ISAC disrupted three criminal services, YAM Store, CoGUI, and Iron Man, that together enabled more than 1 billion malicious messages since January 2026. The action followed cooperation with Japan’s National Police Agency and was carried out under an order from the US District Court for the Southern District of Florida.
How many messages did the network send?
According to Microsoft and reporting from The Verge, the network sent more than 1 billion malicious messages since January 2026, targeting over 75,000 organizations worldwide, with more than 750 million of those messages aimed at Microsoft customers specifically.
Was anyone arrested in connection with this takedown?
No source currently available confirms any specific arrest, criminal charge, or conviction tied to this case. This was a civil legal action resulting in domain seizures and account disabling, not a criminal prosecution.
Is this network confirmed to be based in China?
No. Secondary reporting has suggested a possible link to Chinese-speaking criminal groups, but Microsoft’s own announcement does not confirm the network’s country of origin or the nationality of its operators. That detail remains unconfirmed.
What is Health-ISAC and why was it involved?
Health-ISAC is the Health Information Sharing and Analysis Center, a nonprofit that pools cybersecurity threat intelligence primarily for healthcare-sector organizations. It co-petitioned with Microsoft for the court order used in this takedown, suggesting the scam network’s targets extended into healthcare-adjacent organizations.
Will this stop phishing attacks against Microsoft 365 users?
Not entirely. The takedown removes specific infrastructure tied to YAM Store, CoGUI, and Iron Man, but criminal operators frequently rebuild similar services under new domains. Businesses should keep multi-factor authentication and phishing awareness training in place rather than assuming the threat is fully resolved.
How does this compare to past Microsoft cybercrime takedowns?
Microsoft’s Digital Crimes Unit has used civil court orders to seize domains and disable accounts tied to criminal infrastructure for more than a decade. This case follows that same legal playbook, with the added element of direct cooperation with a foreign law enforcement agency, Japan’s National Police Agency, and a sector-specific partner, Health-ISAC.
What should IT teams do in response to this news?
IT administrators should watch for any follow-up indicators of compromise or blocklists Microsoft publishes, reinforce multi-factor authentication and conditional access policies, and treat the takedown as a reduction in a specific attack surface rather than a permanent resolution of the phishing-as-a-service threat.