Phishing
Microsoft takes down YAM Store, CoGUI and Iron Man kits
Microsoft and Health-ISAC seized domains behind three Chinese-language phishing services. What the takedown changes and what to block in Entra ID now.
On October 14, Microsoft and Health-ISAC, the healthcare information sharing and analysis center, seized and redirected domains behind three Chinese-language phishing services: the YAM Store marketplace and the CoGUI and Iron Man phishing kits. The order came from the US District Court for the Southern District of Florida. Microsoft tracks YAM Store as Storm-3119 and the developers of the CoGUI, Haozi and Iron Man System kits as Storm-2990.
Since January 2026 the three services enabled more than 1 billion phishing emails and SMS messages aimed at more than 75,000 organizations in over 150 countries. More than 750 million of those messages targeted Microsoft customers. Microsoft names healthcare, financial services, wholesale distribution and IT as the main sectors, with the United States and Japan hit hardest.
How the ecosystem worked
The three services sold to each other and to anyone with cryptocurrency. YAM Store is an initial access broker, a seller of footholds others use for attacks. It offered Microsoft 365 and Google environments that were compromised or obtained by fraud. Microsoft's On the Issues post says the operators bought domains that legitimate organizations, often non-profits and schools, had let expire, then used them to obtain Microsoft 365 accounts for resale. Microsoft Threat Intelligence and The Hacker News describe app-only admin panels, which act through an application's own credentials with no user sign-in, used to grant broad Microsoft Graph permissions and full SharePoint API control. The tenant's SharePoint and OneDrive storage then became bulk hosting for phishing content.
The kits are licensed phishing-as-a-service. A buyer gets lure pages and an operator panel; the pages sit behind geofencing (only visitors from chosen countries see the content), fake CAPTCHA gates and IP allow and block lists, all meant to keep security scanners out. Anything a victim types, including card numbers and one-time codes, goes to the operator over a WebSocket connection in real time, so the operator can decide what page to show next while the victim waits. Telegram bots alert the buyer when someone bites.
Resecurity counted 2,360 Iron Man lure packages covering 130 countries and areas. Microsoft's own figure is more than 2,335 templates for 139 countries, and its On the Issues post says over 150. The lures pose as banks, retailers, healthcare providers, transport authorities, police and government agencies. Microsoft notes that a brand appearing in a template does not mean that organization was breached.
The payoff came three ways: stolen credentials, stolen card data used to buy high-end goods, and abuse of the device code sign-in flow to obtain Microsoft tokens.
What attackers were doing
Proofpoint first saw CoGUI campaigns aimed at Japan in late 2024. Iron Man System was advertised from June 2026 and had largely replaced CoGUI by mid-2026. Japan's National Police Agency (NPA) alerted Microsoft to campaigns against people in Japan in late 2025, which started the investigation. Microsoft and The Record put operator earnings in the tens of millions of dollars.
Proofpoint counted about 17,000 unique domains used by CoGUI and two related kits it tracks, CoAceV and CoFish_Ws. Japan's Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs supported the case.
What a takedown does and does not do
Seizing domains breaks running infrastructure. Microsoft says Iron Man's licence server domain is hard-coded into the kit, and Resecurity notes the kit must contact that server regularly to work, a dependency it says favors defenders: without the licence server, deployed copies need a new build. Microsoft also disabled more than 20,000 YAM Store accounts and is blocking more than 100,000 impersonation and fraud domains.
It does not remove the developers, their source code, their customer lists or the data already stolen. After Proofpoint published on CoGUI, the developer changed the kit's network traffic, two sibling kits appeared, and buyers later moved to Iron Man. Steven Masada, who runs Microsoft's Digital Crimes Unit, wrote of the scam messages themselves: "Delete and block one, and another takes its place." The same applies to the kits, so plan for rebuilt versions on new domains using the same techniques. The controls below target those techniques, which is why they keep working when a kit changes its name.
What to do
1. Close the device code route
Last month's EvilTokens takedown covered how device code phishing works. The fix is a Conditional Access policy. In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies > New policy. Include all users and exclude your break-glass accounts, target All resources, then under Conditions > Authentication flows set Configure to Yes and select Device code flow. Under Grant choose Block access, and create it in Report-only.
Before switching it on, open the sign-in logs and filter Authentication Protocol to Device code. Legitimate users are usually meeting-room devices and a few command-line tools; give those a separate, narrow policy. Any ordinary user account in that list since January deserves a look, and if one looks wrong, revoke its sessions as well as resetting the password.
2. Make stolen passwords and codes worthless
Kits that relay what the victim types defeat SMS codes and push approvals. Require phishing-resistant MFA (passkeys, Windows Hello for Business or certificate-based authentication) with the built-in Phishing-resistant MFA authentication strength in Conditional Access, starting with admin roles. Microsoft also advises allowing MFA and passkey registration only from trusted locations or devices, through a policy on the Register security information user action. Phishing-resistant MFA does not stop device code abuse, because the victim signs in on the real Microsoft page; that is why step 1 matters.
3. Treat SMS lures as a separate channel
Text messages about unpaid tolls or fines reach personal and work phones and never touch your mail filter. On managed phones, mobile threat defense with web protection (Microsoft Defender for Endpoint on Android and iOS includes it) can block lure links opened from messages. Tell staff that no bank, police force or toll agency will ask them to sign in to a work account from a text, and give them one way to report one. Finance teams should know that stolen corporate card data is a stated goal of these kits.
4. Check your own tenant
- In Entra ID > Audit logs, filter for Consent to application, Add service principal and Add service principal credentials. Microsoft says YAM Store set up the PnP Management Shell app and granted Graph permissions such as AppCatalog.ReadWrite.All on hijacked Global Administrator accounts.
- Under Enterprise applications, review apps holding application permissions to SharePoint or Graph that nobody can explain.
- In Entra ID Protection, review risky sign-ins and users since January for atypical travel and unfamiliar sign-in properties.
- If your organization ever let a domain expire that was verified in Microsoft 365 or Google Workspace, find out who owns it now. A re-registered old domain is exactly what YAM Store resold.
Our safeguarding and hardening work covers Conditional Access, authentication flows and MFA registration in Microsoft 365, and our security operations team watches sign-in and consent activity for the patterns above. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Microsoft On the Issues, Microsoft Security Blog, Proofpoint, CyberScoop, BleepingComputer, The Hacker News, The Record, eSecurity Planet, Microsoft Learn: block authentication flows, Microsoft Learn: authentication flows.