Skip to content
Sign in
Geopolitics · Asia Pacific

Microsoft disrupts three scam stores linked to attacks on 75,000 organizations

Microsoft and Health-ISAC secured a U.S. court order to seize and redirect domains supporting three services linked to phishing and compromised cloud accounts. Microsoft said it disabled more than 20,000 accounts tied to YAM Store and is continuing to block more than 100,000 impersonation and fraud domains.

AI-assisted synthesis · Based on 5 outlets' reporting · Article text read from 2 of 5 outletsHow it's made

View timeline · 9 entries
5 outlets3 regionsLatest reporting 4 min read
Coverage: Too few ratedL 0 · C 2 · R 0 · 3 unrated
File photo
Photo: Jelson25 / Wikimedia Commons (Public domain)

What happened

Key facts

  • The article says the stores’ operations targeted more than 75,000 organizations globally.
  • The article says more than 750 million fraudulent messages were directed at Microsoft customers.
  • Microsoft’s Steven Masada said routine scam messages can be part of larger transnational criminal networks.
  • The action was authorized by an order from the US District Court for the Southern District of Florida.

The brief

Microsoft and Health-ISAC secured a U.S. court order to seize and redirect domains supporting three services associated with phishing and compromised cloud accounts. The services, named YAM Store, CoGUI and Iron Man, were linked to attacks affecting more than 75,000 organizations. The order came from the U.S. District Court for the Southern District of Florida.

The reporting connects the services to more than 1 billion malicious messages. The Times of India says more than 750 million fraudulent messages were directed at Microsoft customers alone. That figure describes a subset of the broader reported message total, rather than a competing estimate of the same quantity.

Microsoft said it disabled more than 20,000 accounts linked to YAM Store and continued blocking more than 100,000 impersonation and fraud domains. The accounts and domains are distinct measures in the reporting: one concerns accounts associated with a named service, while the other describes domains Microsoft says it is blocking.

The sources do not specify how many of the domains were among those seized and redirected under the court order. The services sold compromised cloud accounts and phishing tools, according to the reporting. CryptoSlate says suppliers accepted USDT and ETH.

The Times of India describes the stores as Chinese-language cybercrime operations and reports that payment methods included Alipay, WeChat Pay and Tether. The accounts and tools were used to target organizations, while the broader message campaign also reached Microsoft customers.

The Times of India traces the inquiry to late 2025, when Japan’s National Police Agency alerted Microsoft to phishing surges affecting Japanese residents. Microsoft’s Steven Masada said ordinary-looking scam messages can form part of larger transnational criminal networks.

The account establishes the alert and the subsequent investigation as reported context; it does not establish that the alert alone prompted the court action. The two detailed accounts emphasize different aspects of the operation. The Times of India highlights the Japanese police alert, the reported message volume and the stores’ payment options.

CryptoSlate focuses on the crypto payments, the sale of credentials and tools, and Microsoft’s account- and domain-blocking measures.

The Next Web’s headline also links the operation to 1 billion scam messages, while GBHackers’ headline singles out CoGUI and cites more than 100 million malicious emails a month; Industrial Cyber’s headline emphasizes critical infrastructure and healthcare. Those headlines corroborate their respective broad descriptions but do not provide further details about the operation.

The documented action combines a court-authorized domain seizure and redirection with Microsoft’s disabling of accounts and blocking of domains. The reporting does not quantify how many organizations were affected by each service, how much money the operators received, or how the domain action altered the services’ operations.

The next measurable developments in the account are whether Microsoft blocks additional domains and whether investigators or the company report further action against the named services.

Why it matters

  • Organizations targeted by the services face phishing and compromised-account threats; the reported campaign was linked to more than 75,000 organizations.
  • Microsoft customers were sent more than 750 million fraudulent messages, according to The Times of India, making the message volume a direct measure of exposure to the reported activity.
  • Microsoft’s disabling of more than 20,000 YAM Store-linked accounts and continued blocking of more than 100,000 impersonation and fraud domains show the separate account and domain mechanisms used in the disruption.
  • Suppliers accepted USDT and ETH for compromised cloud accounts and phishing tools, while The Times of India also reports Alipay, WeChat Pay and Tether as payment methods.

What to watch next

  • Whether Microsoft reports further blocks among the more than 100,000 impersonation and fraud domains it said it was continuing to block.
  • Whether Microsoft reports additional account disabling tied to YAM Store, CoGUI or Iron Man.
  • Whether investigators or the court report further action connected to the U.S. District Court for the Southern District of Florida order.
  • Whether Microsoft or Health-ISAC provides further information on the seized and redirected domains supporting the three named services.

How it's being covered

Coverage analysisShow details
5 source articles · 5 unique outlets
Outlet political mix: Too few rated· 2 Center · 3 unrated
Where the outlets are based: Unknown 40% · Europe 20% · Other 40%
Outlet political mix
Too few rated
Left
Center
Right
0 outlets
2 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once. 3 unrated outlets are not included.
Geography
Where the outlets covering this story are based.
5 unique outletsDominant coverage: Europe
How we measure coverage

How outlets' accounts compare

2 framing differences · 2 uncorroborated claims · 3 information gaps
The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 2 reports whose article text Updat3 read; 3 other outlets were checked by headline only.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • The Times of India emphasizes the Japanese police alert, message volumes and reported payment methods; CryptoSlate emphasizes crypto payments, the sale of credentials and tools, and Microsoft’s account and domain blocking.
  • The Next Web headline describes Chinese-language phishing kits and 1 billion scam messages; GBHackers highlights CoGUI and a monthly email figure; Industrial Cyber foregrounds critical infrastructure and healthcare.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • The Times of India says the investigation originated after Japan’s National Police Agency alerted Microsoft to phishing surges in late 2025; the sources do not establish that the alert alone caused the later court-authorized action.
  • Microsoft’s Steven Masada said routine scam messages can be part of larger transnational criminal networks.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The sources do not provide a breakdown of affected organizations by sector or geography.
  • The sources do not quantify losses to targeted organizations or customers.
  • The reporting does not explain how the more than 100,000 domains Microsoft says it is blocking relate to the domains seized and redirected under the court order.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. The United States enacted the Computer Fraud and Abuse Act in 1986, establishing federal offenses related to unauthorized access to computers.
    Background · from our historical context
  2. Japan’s Act on Prohibition of Unauthorized Computer Access took effect in 1999 and made unauthorized access to computer systems a criminal offense.
    Background · from our historical context
  3. The Council of Europe opened the Budapest Convention on Cybercrime for signature.
    Background · compiled and fact-checked by Updat3
  4. The Anti-Phishing Working Group was established in 2003 to coordinate research and reporting on phishing.
    Background · from our historical context
  5. Microsoft formed its Digital Crimes Unit in 2008 to pursue cybercrime through technical investigations and legal action.
    Background · from our historical context
  6. The Health Information Sharing and Analysis Center was established to share threat information among healthcare organizations.
    Background · compiled and fact-checked by Updat3
  7. Japan became a party to the Budapest Convention on Cybercrime.
    Background · compiled and fact-checked by Updat3
  8. A U.S. federal court authorized Microsoft to seize domains used by the Bladabindi/Jenxcus malware network.
    Background · compiled and fact-checked by Updat3
  9. In late 2025, Japan’s National Police Agency alerted Microsoft to phishing activity, providing a direct lead for investigators examining services used to target organizations.
    Background · from our historical context

How we got here

In late 2025, Japan’s National Police Agency alerted Microsoft to phishing activity, providing a direct lead for investigators examining services used to target organizations. The United States enacted the Computer Fraud and Abuse Act in 1986, establishing federal offenses related to unauthorized access to computers.

Japan’s Act on Prohibition of Unauthorized Computer Access took effect in 1999 and made unauthorized access to computer systems a criminal offense. The Council of Europe opened the Budapest Convention on Cybercrime for signature on November 23, 2001; it created a framework for international cooperation and electronic-evidence procedures, and Japan became a party in 2012.

Original sources

5 articles from 5 outlets

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.