‘What appears to be a simple fraudulent message is often the visible end of a much larger transnational cybercriminal operation’: Microsoft leads global takedown of phishing network that sent more than a billion messages
- Microsoft helped dismantle a cybercrime marketplace that sold phishing scam tools, accounts, and infrastructure.
- The CoGUI and Iron Man platforms enabled large-scale phishing campaigns targeting organizations around the world.
- The operation generated more than one billion phishing messages before domains and thousands of accounts were seized.
Late last year, Microsoft set out to investigate what appeared to be another phishing campaign.
However, what he discovered beneath the surface was much bigger: it was a sprawling Chinese-language cybercrime market where countless threat actors were buying, trading, and selling digital accounts, web hosting services, as well as different tools needed to create spoofed websites and fake identities.
The company has now revealed how it led the effort to take down the market, alongside private cybersecurity companies, including Proofpoint, and Japanese law enforcement agencies.
Latest videos ofTechnologyRadar
YAM, CoGUI and Iron Man Store
The investigation began after Japan’s National Police Agency (NPA) alerted Microsoft about a wave of fraud and scams targeting both individuals and companies in the country.
Researchers discovered a major underground marketplace called the YAM Store, where they saw fraudulent Microsoft and Google accounts being offered for sale, as well as different tools ready to carry out scams, including credential theft.
Two specific tools stood out in the store: CoGUI and Iron Man. The former appears to be a website building framework, while the latter, a template gallery.
“CoGUI provided criminals with ready-made websites and messages posing as companies, financial institutions, government agencies, and other trusted organizations,” Microsoft explained. “Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”
According to researchers, CoGUI became one of the most used offerings in the ecosystem, primarily to target victims in Japan and the United States. However, by mid-2026, Iron Man steadily replaced him:
“Iron Man expanded the model by giving criminals access to thousands of ready-made templates designed to impersonate trusted organizations,” the researchers said. “Criminals could then quickly deploy emails, text messages and web content tailored to specific brands, industries and countries.”
Microsoft said the tool offered more than 2,300 templates from different banks, retailers, healthcare providers, police departments and other organizations, located in more than 150 countries around the world.
The store and its offers were very popular among the cybercriminal community. This year alone, they delivered more than one billion phishing messages targeting 75,000 organizations around the world. Microsoft customers alone have received more than 750 million of these messages since the beginning of the year.
These attacks resulted in “tens of millions of dollars” in profits for operators.
Dismantling of the operation
The network is now being taken down, Microsoft claimed. After receiving the order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC (a global nonprofit organization that helps healthcare companies share cyber intelligence) seized and redirected the domains leading to the YAM Store, CoGUI, and Iron Man. At the same time, Microsoft disabled more than 20,000 accounts connected to the store and “continues to dismantle the operation by removing the infrastructure hosted on its services.”
So far, the action has blocked more than 100,000 domains used for both spoofing and fraud.
“What began with fraudulent activity targeting individuals and organizations in Japan led investigators to an underground service economy that supplied criminals around the world,” the researchers concluded.
“YAM Store, CoGUI and Iron Man are just part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they depend on.”
While tearing down infrastructure is commendable, without arrests the market is likely to re-emerge sooner or later. For example, when law enforcement took down two major platforms, Cracked and Nulled, in early 2025, they arrested two suspects and confiscated 17 servers and more than 50 electronic devices.
Cracked and Nulled, forums that offered illegal goods and cybercrime as a service, had more than 10 million users in total, and investigators estimated that the arrested suspects earned more than $1 million in criminal profits.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment