An action by Microsoft and Health-ISAC took down the infrastructure of a network tied to more than 1 billion scam messages since January 2026. The targets were consumers and more than 75,000 organizations, and over 750 million of the messages were aimed at Microsoft customers.
A ready-made scam store
According to eSecurity Planet, the operation took down three linked services. YAM Store was an underground marketplace selling access to fraudulently obtained Microsoft and Google cloud accounts and environments. CoGUI was a phishing kit, with fake websites and messages imitating real organizations. Iron Man offered more than 2,300 templates posing as banks, retailers, healthcare providers and government agencies in more than 150 countries.
The criminal did not need to know how to code. They bought the kit, picked a template and fired off messages by email and text.
What went offline
The action had a US federal court order, from the Southern District of Florida. By October 14, more than 20,000 accounts tied to YAM Store had been disabled and more than 100,000 domains used in fraud were being blocked. The investigation began with Japan’s National Police Agency, which was looking into fraudulent campaigns in the country.
The limit is clear: the action hit infrastructure suppliers, not each campaign. The phishing ecosystem is still standing, and new kits tend to appear.
Being imitated is not being breached
Microsoft offers a useful note for anyone receiving a scam message: a company being imitated by a template does not mean its systems were compromised. Some of the domains came from organizations that let their registration lapse, and others belonged to fake companies created just to get cloud services. The messages looked credible because they came from apparently legitimate infrastructure.
How to protect yourself
- Do not click links in unexpected messages about a blocked account, a pending issue or a prize. Open the site by typing the address or use the official app.
- Confirm through another channel. If your bank or an agency “warned” you, call the number on your card or the official website.
- Turn on two-step verification, preferably with an app or a security key, not only by text message.
- Watch for odd sign-ins. New-login alerts deserve immediate attention, and it is worth ending open sessions.
- Report the scam to the service that was imitated, so the link gets taken down.
