Microsoft seizes domains of phishing services behind over 1 billion scam messages
Microsoft and a health care security group took over the web domains of three Chinese-language scam services, SecurityWeek and CyberScoop reported. A U.S. court order allowed the move. Microsoft said the services were used to send more than 1 billion scam texts and emails this year.
Microsoft and Health-ISAC, a group that shares security information across the health care industry, have seized web domains used by three Chinese-language cybercrime services, SecurityWeek, CyberScoop and Cybersecurity Dive reported.
The services, called YAM Store, CoGUI and Iron Man, supplied criminals with stolen accounts, phishing kits and other tools, SecurityWeek reported. The action was based on an order from the U.S. District Court for the Southern District of Florida. A federal judge granted the request on Oct. 7, Cybersecurity Dive reported.
According to Microsoft, the three services were used to send more than 1 billion malicious messages since January 2026, SecurityWeek reported. The messages targeted more than 75,000 organizations in over 150 countries, and more than 750 million were aimed at Microsoft customers. The operators made tens of millions of dollars, Microsoft said.
Microsoft has disabled more than 20,000 accounts tied to YAM Store, CyberScoop reported. It is also blocking more than 100,000 domains used for impersonation and fraud.
The scam messages warned about things like undelivered packages, unpaid tolls and overdue tax bills, Microsoft said, CyberScoop reported. "These messages are relentless," Steven Masada of Microsoft's Digital Crimes Unit wrote in a blog post, CyberScoop reported. "Delete and block one, and another takes its place."
Health-ISAC joined the lawsuit because the tools were often used to target hospitals and health care groups, SecurityWeek reported.
Security firm Resecurity bought a license for the Iron Man kit and tested it in a lab, SecurityWeek reported. It counted 2,360 templates covering 130 countries and areas. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs helped with the investigation, both SecurityWeek and CyberScoop reported.
Microsoft said the takedown would put only a dent in the wider phishing world, Cybersecurity Dive reported. But Masada wrote that it "makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on."
What we know: Microsoft and Health-ISAC seized the domains of YAM Store, CoGUI and Iron Man under a federal court order.
What we don't: Who runs the services and whether they will set up new domains.
Where outlets agree SecurityWeek and CyberScoop both report that the services sent more than 1 billion malicious messages to more than 75,000 organizations this year.
Where they differ SecurityWeek and Cybersecurity Dive say the investigation began after a tip from Japan's National Police Agency in late 2025, while CyberScoop says Microsoft and Japanese authorities started investigating in early 2025.