Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals

1. Executive summary

Microsoft's Digital Crimes Unit, working with Japan's National Police Agency and Health-ISAC, obtained a U.S. court order to seize and redirect domains belonging to three phishing platforms (YAM Store, CoGUI and Iron Man) and disabled more than 20,000 accounts tied to YAM Store. The three platforms carried over 750 million messages against Microsoft customers since January 2026 and targeted consumers, healthcare, financial institutions and other businesses in more than 150 countries, with credential, banking and personal-data theft as the objective. No CVE is involved and the verified reference data records no CISA KEV entry, so there is no patch to apply; the exposure is operational, because the kits impersonate banks and financial institutions and the infrastructure that hosted them is only partly removed. EMEA financial services clients should treat this as a partial disruption of a live phishing supply chain, not a closure, and expect operators to migrate to surviving kits and rebuilt domains.

2. Regulatory framing

No DORA incident-reporting article is engaged by this item: the disruption is a law-enforcement and vendor action against criminal infrastructure, not an ICT-related incident at a client. If a client later confirms it was a victim of one of these kits, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become relevant at that point, on the client's own facts.

3. Technical analysis & attack chain

This is a disruption item, not a vulnerability. There is no exploited CVE, no malware sample and no patch. The verified reference data records no CISA KEV entry and no CVSS score for this item, and none should be inferred.

Confirmed steps, as described by Microsoft and The Record:

1. Operators built or bought phishing infrastructure through three platforms: YAM Store, CoGUI and Iron Man.
2. YAM Store functioned as an initial access broker marketplace. It sold infrastructure built on compromised or fraudulently obtained environments in providers including Microsoft and Google, priced and filtered by account age, subscription type and environment type (education .edu and non-profit .org environments are named).
3. YAM Store also sold domains tied to legitimate or expired organisation names. Operators bought domains that real companies had allowed to expire and rebuilt websites on them to look like legitimate platforms.
4. CoGUI supplied ready-made websites and messages impersonating trusted brands, companies, government agencies and financial institutions. It was used heavily against people in Japan.
5. Iron Man, a phishing-kit-as-a-service operation, supplied more than 2,300 pre-built lure pages impersonating postal companies, traffic fine offices, tax agencies, banks and telecoms, with templates tailored for Australia, Japan, India and other countries. Operators could deploy email, text and web content tailored to a specific brand, industry and country.
6. Cybercriminals shifted from CoGUI to Iron Man from the middle of 2026.
7. The campaigns stole credentials, personal information, banking data and other login information. Stolen Microsoft 365 credentials were resold on YAM Store.
8. Microsoft, with the Japan National Police Agency and Health-ISAC, obtained a U.S. court order, seized and redirected domains, disabled more than 20,000 accounts connected to YAM Store, and blocked more than 100,000 domains used for impersonation. Microsoft states it is still removing infrastructure hosted on its services.

The investigation found similarities between the infrastructure of YAM Store, CoGUI and Iron Man, which Microsoft reads as close collaboration among their developers or shared development. That is Microsoft's assessment, not an independently corroborated finding.

Attribution and confidence caveats. The actor is described in the source as "Chinese cybercriminals" and as a Chinese-language cybercrime ecosystem. The verified reference data holds no MITRE ATT&CK profile for this actor, so the attribution is unconfirmed and should not be used as a basis for blocking by geography or language. The technical detail above rests on a single vendor's account (Microsoft, reported by The Record); the 750 million message figure, the 20,000 disabled accounts and the 100,000 blocked domains are Microsoft's own numbers and have not been independently verified. Treat them as single-sourced.

What is not in the source: no file hashes, no domains, no IP addresses, no email sender addresses, no kit file names, no command-and-control details, no specific bank brands impersonated, and no victim organisations named. The advisory cannot supply them.

4. Mitigation & containment

There is no patch. The actions below address the two exposures the item actually creates: your staff and customers being phished by these kits, and your own domains or cloud identities being enrolled in the infrastructure.

P1 (within 24 hours)

• Confirm your domain portfolio has no lapsed or soon-to-lapse registrations that a third party could re-register and rebuild as a lookalike of your brand. Expired-domain abuse is the named mechanism in this item. Pull the expiry list for every customer-facing domain and renew or park anything inside 90 days.
• Check Microsoft 365 and Google Workspace tenant for accounts you do not recognise, particularly accounts with .edu or .org environment associations if you operate any. Microsoft disabled 20,000 accounts on its own side; yours are yours to find. Review sign-in logs for successful authentications from infrastructure you cannot account for.
• Push a staff-facing warning naming the lure categories in this item: postal and delivery notices, traffic fine notices, tax agency notices, bank and telecom impersonation. These are the Iron Man template categories, not generic phishing advice.

P2 (within 72 hours)

• Enforce phishing-resistant MFA (FIDO2 or passkeys) on Microsoft 365 and Google Workspace for any role that can approve payments, change bank details, or access customer data. Credential theft is the objective of all three kits; MFA that resists real-time relay removes the resale value of a stolen password.
• Review mail and web filtering for the impersonation pattern: newly registered or recently re-registered domains presenting as your brand or as a postal, tax, telecom or bank brand. Microsoft blocked 100,000 impersonation domains; your filter should be catching the same shape.
• If you have a customer-facing brand, run a lookalike-domain sweep against your own name and report anything live to your registrar and to the relevant takedown channel.

P3 (within 7 days)

• Add a callback verification step to any process where a customer or counterparty changes bank details, and to outbound payment instructions. The kits steal banking data; the control that stops the resulting fraud is a verified callback on a number you already hold, not a number supplied in the message.
• Brief fraud and customer-protection teams that the disruption is partial. Microsoft states it is still removing infrastructure, and operators were already migrating between kits during 2026. Expect continued volume.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The sources name no domains, IP addresses, URLs, email addresses, file hashes, file names or registry keys. The platform names YAM Store, CoGUI and Iron Man are service names, not indicators, and should not be used as blocklist entries.

The sources do describe observable behaviours. These are listed below for detection and hunting; they are not machine-pivotable atomic indicators and are not reproduced in a copyable block.

Behavioural indicators

6. Detection

The sources contain no file artefacts, no command lines, no mutexes, no registry keys and no file paths. There is nothing to build a YARA rule from, and a rule keyed on the platform names would detect reporting about the threat rather than the threat. No YARA rule is emitted.

A Sigma rule is possible for the one behaviour with a log source: authentication against Microsoft 365 from infrastructure the organisation cannot account for, in the context of a credential-phishing campaign. The rule below uses only fields present in Entra ID sign-in logs and does not depend on any indicator the source does not provide.

title: Microsoft 365 Sign-In From Unfamiliar Autonomous System With Successful Authentication
id: 8f2c1a44-7b6e-4d19-9c3a-2e5f0b7d1a63
status: experimental
description: >
  Flags successful Microsoft 365 authentication from an autonomous system not
  previously seen for the account, consistent with credential theft and resale
  described in the YAM Store, CoGUI and Iron Man phishing platform disruption.
  Tune the baseline window and the ASN allowlist before enabling.
author: Adverse Trace
date: 2026-10-14
references:

  - https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 0
    RiskLevelDuringSignIn:

      - medium
      - high
  filter_known:
    AutonomousSystemNumber|cidr:

      - '0.0.0.0/0'
  condition: selection and not filter_known
falsepositives:

  - Corporate VPN egress and legitimate travel
  - Newly onboarded staff or contractors
level: medium

The filter_known block is a placeholder for your own known-ASN allowlist and must be populated before the rule is enabled. As written it suppresses nothing and will alert on all successful sign-ins with elevated risk.

7. Sources

• The Record, "Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals", https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms, 2026-10-14.

This is the only source provided. All technical detail in this advisory derives from it, and the underlying claims originate with Microsoft's Digital Crimes Unit.

8. Adverse Trace position

Adverse Trace assesses this as a medium-severity operational item for EMEA financial services, not a critical one: there is no CVE, no CISA KEV entry and no CVSS score in the verified reference data, and the disruption has already been executed by Microsoft and law enforcement. The client impact is real but indirect. The kits impersonate banks and financial institutions, they steal banking data and Microsoft 365 credentials, and the takedown is explicitly incomplete, with Microsoft still removing infrastructure and operators already observed migrating from CoGUI to Iron Man during 2026. The attribution to Chinese cybercriminals is unconfirmed: the verified reference data holds no MITRE ATT&CK profile for this actor, and the technical detail rests on a single vendor account, so we are not treating the attribution as established. We will monitor for follow-on reporting that names the specific brands impersonated, any domains or sender infrastructure that survive the takedown, and any confirmed victim notifications in the financial sector, and we will issue a follow-up advisory if atomic indicators become available. Clients who confirm they were phished by one of these kits should treat it as their own incident and assess DORA Art. 17 to 19 and NIS2 Art. 23 reporting against their own facts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.