Microsoft Says It Seized Domains Behind YAM Store, CoGUI and Iron Man, a Phishing Supply Chain Tied to More Than 1 Billion Messages

NEW YORK - Microsoft said on Oct. 14, 2026 that it and Health-ISAC, acting under an order from the U.S. District Court for the Southern District of Florida, seized and redirected domains that powered YAM Store, CoGUI and Iron Man, three parts of a Chinese-language cybercrime marketplace that sold criminals cloud accounts, phishing kits and hosting. Microsoft says the three services have enabled more than one billion malicious emails and text messages aimed at more than 75,000 organizations in more than 150 countries since January 2026, including more than 750 million messages directed at Microsoft customers. The company's Digital Crimes Unit says it has disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud. Microsoft Threat Intelligence tracks YAM Store as Storm-3119 and the developers behind the CoGUI, Haozi and Iron Man System kits as Storm-2990. For SOC and identity teams, the case is less about a single malware family than about a supply chain: hijacked Microsoft 365 tenants, ready-made brand templates, and real-time credential capture that operators watch through Telegram.

The investigation began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan. The Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later contributed intelligence, and Microsoft says it shared intelligence with the U.S. Secret Service and international law enforcement partners. Proofpoint, which provided threat data and a declaration for the civil suit, says CoGUI and two related kits it calls CoAceV and CoFish_Ws are the highest-volume direct email threats in its campaign data. It says it detects and blocks more than 100 million CoGUI messages a month, has observed about 17,000 unique domains across the three kits since it began tracking them, and counted 3,788 unique fully qualified domain names between July 1 and Sept. 17, 2026 alone. Proofpoint says 66 brands have been impersonated, most of them Japanese, and that financial services and healthcare are the most frequently hit sectors in its data. Visitors to the seized domains now see a Microsoft seizure notice.

The most useful detail for responders is how Storm-3119 builds its inventory. Microsoft describes a five-stage pipeline. Automated reconnaissance written in Flask, run anonymously over Tor, discovers Microsoft 365 tenants and gathers licensing and Azure information. Actor-controlled admin panels, built in PHP, Java/Spring and Cloudflare Workers, then use a compromised tenant's client secret in an application-only authentication flow to take full directory control: they reset passwords silently without forcing a change at next sign-in, assign education licenses and grant privileged attributes. Microsoft says the actor then signs in to a compromised Global Administrator account, self-provisions the PnP Management Shell service principal, grants itself broad Microsoft Graph permissions including directory read and write and AppCatalog.ReadWrite.All, takes full control of the SharePoint API, and turns the tenant's SharePoint and OneDrive into bulk hosting for sale. A custom DNS platform manages phishing domains, SSL certificates and routing through Cloudflare, and the storefront takes Alipay, WeChat Pay and USDT on TRC20 with a sub-reseller tier, using Telegram for order notifications. Microsoft says Storm-3119 also targets expired organization names and creates fraudulent organizations, likely with AI-generated content and forged documentation, including a fabricated nonprofit tied to a .org domain registered only months earlier.

Iron Man System, which YAM Store began advertising in June 2026, is where the volume comes from. Microsoft says the kit holds more than 2,335 templates tailored to more than 139 countries, with the United States carrying the most and U.S. lures leaning on transportation and government themes such as traffic and parking fees. Customers buy a subscription to a license server whose domain is hard-coded into the kit. The Storm-2990 kits support geofencing, fake CAPTCHA gates, IP allow and block lists, anti-detection settings and Telegram bot integration, and collect submissions over a WebSocket so an operator can watch each victim and prompt for verification codes in real time. Microsoft says the Iron Man panel is built on the GoFrame Go framework and hosted mostly with China-based providers, and that downstream buyers used the infrastructure for credential theft, device code phishing and payment fraud. Resecurity, which bought an Iron Man license and ran it in an isolated lab, says panel version 6.3.1 polled its local license-status endpoint about every 20 seconds, triggering calls to the authorization host api2[.]peaceman[.]cc, and that the group's self-hosted build registry exposed 911 published image versions. Resecurity counted 2,360 templates across 130 countries and areas, the newest added on Oct. 1, and says the licensing dependency favors defenders because disabling that host would degrade every active deployment at once.

Microsoft cautions that the ecosystem is not limited to its own services and that YAM Store, CoGUI and Iron Man are only part of a larger criminal network, so the seizures raise cost rather than end the threat. Its guidance centers on passkeys and phishing-resistant multifactor authentication, Conditional Access policies scoped to privileged accounts, allowing MFA and passkey registration only from trusted locations and devices, least privilege for Global Administrator roles, Safe Links for internal recipients, and network protection to block malicious domains. Microsoft's report lists Defender coverage for the downstream activity, including Entra ID Protection alerts for atypical travel, malicious IP addresses and password spray, and Defender for Office 365 alerts for malicious URL clicks. For tenant owners, the Storm-3119 pipeline also translates into concrete audit checks in Entra and Microsoft 365 logs: unexpected provisioning of the PnP Management Shell service principal, application-only credentials writing to the directory, new AppCatalog.ReadWrite.All grants, password resets that do not require a change at next sign-in, sudden education license assignments, and SharePoint or OneDrive storage that starts serving content no one in the organization recognizes. Network teams can add the Resecurity licensing, telemetry and storage hosts, including api2[.]peaceman[.]cc, log2[.]peaceloving[.]xyz and ossapi[.]haoeryu[.]top, to blocklists and hunting queries.