Microsoft and Health-ISAC have seized and redirected domains linked to three Chinese-language cybercrime services: YAM Store, CoGUI and Iron Man, Microsoft has said.
Since January 2026, the services have facilitated more than one billion malicious messages targeting over 75,000 organisations worldwide, according to the company.
More than 750 million of the messages targeted Microsoft customers, while victims included consumers, healthcare organisations, banks and other businesses across more than 150 countries.
The operations generated tens of millions of dollars in revenue for their operators.
“What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.” Steven Masada, general manager of Microsoft’s Digital Crimes Unit.
The investigation began in late 2025 after Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in the country.
The operation later expanded to include the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.
Microsoft also shared intelligence with the United States Secret Service and international law enforcement agencies.
Microsoft said YAM Store operated like an online marketplace where customers could browse products, compare prices and purchase fraudulent Microsoft and Google accounts, as well as ready-made tools for carrying out scams.
In some cases, its operators acquired expired domains previously used by non-profit organisations and schools, rebuilt the websites and used them to obtain Microsoft 365 accounts for sale. The store accepted payments through Alipay, WeChat Pay and USDT, according to Microsoft Threat Intelligence.
CoGUI provided cybercriminals with ready-made websites and messages designed to impersonate trusted organisations. By mid-2026, a newer service known as Iron Man was increasingly replacing it.
Investigators identified more than 2,300 Iron Man templates impersonating banks, retailers, healthcare providers, police departments and government agencies.
In the US, most of the templates impersonated transport or government services, with scams involving traffic violations and parking fees, Microsoft said.
