Microsoft and Health-ISAC moved on 14 October 2026 to dismantle three pieces of a Chinese-language phishing marketplace: YAM Store, CoGUI, and Iron Man. A US federal court order in the Southern District of Florida backed the domain seizures.

What happened

The trail started with scam campaigns in Japan and widened into a service economy. Criminals bought accounts, hosting, and ready-made pages instead of building each lure themselves. Microsoft tracks the kit cluster as Storm-2990.

Since January 2026 the three services enabled more than one billion malicious email and SMS messages. Those messages hit more than 75,000 organizations in more than 150 countries. More than 750 million were aimed at Microsoft customers. Microsoft says the operators made tens of millions of dollars.

Health-ISAC joined because hospitals were a frequent target. Partners included the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains.

Who is affected

Anyone whose users received package, toll, bank, or tax lures from this ecosystem. Healthcare, finance, logistics, and IT were called out. Resecurity reported 2,360 phishing templates impersonating banks, retailers, healthcare providers, transport, police, and government agencies across 130 countries.

• Organizations that let domains expire, then saw those names rebuilt to mint fraudulent Microsoft 365 tenants.
• Mailboxes that clicked a CoGUI or Iron Man page and entered a password or payment detail.
• Help desks still treating each lure as a one-off, instead of a kit that rotates domains in days.

What to do now

Search the last 90 days for lookalike package, toll, bank, and tax domains, then reset any account that submitted credentials. Do not stop at a password change if a session token or a mailbox rule is still there. Check for inbox rules, OAuth grants, and forwarding that appeared after a reported phish.

Expired domains are part of the supply chain here. Reclaim names you still care about, and watch for Microsoft 365 tenants opened in a former brand name.

Source: Microsoft, disrupting the phishing service economy.

Also on the blog

• CVE-2026-76519: Cisco Secure Email Gateway root via one attachment
• CVE-2026-0322: PAN-OS management root RCE, CVSS 8.6
• DPRK laptop farms: FBI seized 187 devices, 14 charged

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.