Microsoft says it has helped dismantle a Chinese-language cybercrime marketplace that powered a big share of the fake toll, package and bank texts people keep getting. Working under a federal court order with health-sector security group Health-ISAC, it seized and redirected domains behind three services: YAM Store, CoGUI and Iron Man.
Since January, Microsoft says, those three enabled more than a billion malicious emails and texts aimed at over 75,000 organizations in more than 150 countries, about 750 million of them aimed at Microsoft customers, and made their operators tens of millions of dollars. YAM Store worked like an online shop, selling fraudulent Microsoft and Google accounts. Some came from expired domains of real nonprofits and schools that the operators bought and rebuilt to look active. CoGUI and its newer replacement Iron Man sold ready-made phishing kits; Iron Man alone had more than 2,300 templates impersonating banks, retailers, transit agencies and police.
The case started in late 2025, when Japan's National Police Agency flagged scam campaigns hitting people in Japan. Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs also helped. Microsoft says it disabled more than 20,000 accounts tied to YAM Store and blocked over 100,000 domains used for impersonation. Microsoft tracks the people behind the kits as Storm-2990, CyberScoop reports.
— via Microsoft