Key points
- Microsoft led a takedown of the YAM Store, a Chinese-language cybercrime marketplace.
- The store sold CoGUI and Iron Man tools used to create fraudulent websites and messages.
- The operation resulted in the seizure of thousands of accounts and domains before mid-2026.
Microsoft led a global effort to dismantle YAM Store, an underground marketplace that sold phishing tools and stolen accounts. According to TechRadar, the operation targeted a network responsible for sending over a billion phishing messages. The takedown involved private cybersecurity firms like Proofpoint and law enforcement agencies from Japan.
In plain English
YAM Store operated as a digital shop for criminals. Buyers could purchase fraudulent Microsoft and Google accounts, web hosting services, and tools to create fake websites. Two specific products, CoGUI and Iron Man, were central to this operation. These tools allowed attackers to bypass the need for custom coding.
The background
CoGUI provided ready-made websites and messages that impersonated trusted organizations, including banks and government agencies. Users could quickly deploy pages designed to steal passwords and payment information. By mid-2026, Iron Man began replacing CoGUI. It offered thousands of templates tailored to specific brands, industries, and countries for email, text, and web content.
What changes now
The marketplace has been dismantled, and thousands of accounts and domains were seized. Microsoft revealed these details after an investigation began late last year. The probe started when Japan’s National Police Agency tipped Microsoft about fraud targeting individuals and businesses in the country. Researchers traced the activity back to the sprawling Chinese-language store.
Who needs to act first
Security teams should prioritize reviewing email logs for recent phishing attempts that match known templates. Check whether any users clicked links or entered credentials on suspicious pages. Verify the integrity of critical service accounts, especially those with administrative privileges. Monitor for unusual login locations or new devices accessing sensitive data. Ensure that multi-factor authentication is enforced across all user accounts to reduce the impact of stolen credentials.
What to do and how to stay safe: Microsoft
- Review email inboxes for recent messages impersonating trusted brands or government agencies.
- Verify that multi-factor authentication is enabled on all personal and professional accounts.
- Change passwords for any account where you suspect you may have entered credentials on a fake site.
- Report suspicious emails to your organization's security team or email provider for analysis.
Step-by-step guide: How Passkeys Work: The Cryptographic Mechanics Behind Passwordless Login
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What tools were sold on the YAM Store?
The store sold CoGUI, a website building framework, and Iron Man, a template gallery for creating phishing content.
How many phishing messages did this network send?
The operation drove over a billion phishing messages before the domains and accounts were seized.
Which organizations helped take down the YAM Store?
Microsoft led the move alongside private cybersecurity companies like Proofpoint and Japanese law enforcement agencies.
