YAM Store Takedown: Microsoft Seizes the Phishing-as-a-Service Empire

Key Takeaway

• 🔐 A US federal court order let Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) seize the domains behind YAM Store, a Chinese-language marketplace that sold phishing kits and stolen cloud accounts as a monthly service.
• 📊 Since January 2026, the kits advertised on YAM Store enabled over one billion malicious messages to more than 75,000 organizations — 750 million of them aimed at Microsoft customers alone (Microsoft Digital Crimes Unit, October 14, 2026).
• ⚖️ This was a civil court seizure, not an arrest wave: Microsoft now controls the seized domains and says the takedown is a dent, not the end of the model.
• 🎯 Scam realism now comes from industrial template farms — the bank name, government seal, or delivery notice on a message proves nothing. Verify senders through official apps only.
• 👀 Expect successors: kit variants and YAM Store-style copycat marketplaces are the watch items, not a victory lap.

That “traffic fine” text or “bank verification” email had a factory behind it. On October 14, Microsoft announced that YAM Store — an underground marketplace that sold phishing kits, hijacked cloud accounts, and license keys to criminals worldwide — lost its core domains to a US court order. The kits it supplied have powered over one billion malicious messages since January 2026, and more than 750 million of those messages targeted Microsoft customers, who include the practical internet users, freelancers, and small business owners who read this site.

If the scam economy has a plumbing aisle, this was it — the supply side our readers already met in the AI scam economy — and the seizure order says buyers now hit dead ends where the checkout used to be.

The Signal: A Court Order Shuts Down YAM Store

Here is what changed, per Microsoft’s security team and SecurityWeek: on October 7, the US District Court for the Southern District of Florida granted Microsoft and Health-ISAC, the nonprofit that shares cyber-threat data among hospitals, control of the domains that hosted the marketplace. The seizure covered the infrastructure behind YAM Store, the CoGUI kit, and the Iron Man System — three components of a Chinese-language cybercrime service economy that Microsoft announced publicly a week later, on October 14.

The scale is the story. Microsoft’s Digital Crimes Unit (DCU), the unit that litigates cybercrime, reports that since January 2026 the phishing kits sold through YAM Store enabled more than one billion phishing emails and text messages, aimed at over 75,000 organizations in more than 150 countries. Steven Masada, the DCU general manager, says over 750 million of those messages were aimed at Microsoft customers. The trail began with a tip from Japan’s National Police Agency in late 2025, when the kits were hammering Japanese victims hardest.

Inside the Machine: How YAM Store Sold Cybercrime as a Service

Phishing-as-a-service (PhaaS) is crime sold on a subscription. The customer is rarely a hacker — more often a fraudster who pays a fee to log into a dashboard, pick a template that looks exactly like a government agency or a bank, point it at a victim list, and watch stolen credentials or card numbers arrive. The kit handles hosting, templates, and page logic; the customer handles the harm. Microsoft describes the kits sold here as carrying their own license servers, with the license domain hard-coded into the kit so a subscription can be enforced the way office software enforces a product key.

YAM Store sat one level higher in the supply chain. Microsoft tracks the marketplace as Storm-3119 and classifies it as an initial access broker — a seller of footholds inside other companies’ clouds. It hijacked Microsoft 365 and Azure for Education tenants (the workspace accounts tied to an organization or a school) and resold the stolen accounts, licenses, and storage “as a service” to downstream buyers, including the phishing kits themselves. Storm-3119 even ran automation that hunts for expired organization names, letting a criminal re-register a dead company’s cloud footprint and look legitimate while doing it.

The three kits advertised on YAM Store — CoGUI (also tagged NX or FA), Haozi (also tagged Phoenix), and the Iron Man System — form the cluster Microsoft tracks as Storm-2990. CoGUI was heavily used against victims in Japan and the United States; by mid-2026 it was increasingly being replaced by Iron Man, which the marketplace started advertising in June 2026. Iron Man is the biggest exhibit of industrial scale: a multi-tenant kit built on the GoFrame web framework, with over 2,335 phishing templates tailored to more than 139 countries, and management panels predominantly hosted on China-based providers.

Money moved the way it does in every modern fraud supply chain: cryptocurrency, including USDT and Ethereum, with Telegram channels used for sales contact and even for live notification during credential theft.

Researchers who dismantled pieces of this economy — the same one exposed in the Integrity Technology Group advisory, which documented the supplier side of hack-for-hire — note that the buyers here were demand-side criminals: kit subscribers hunting credentials and payment data. Microsoft’s security team assesses with high confidence that the kits were developed by Chinese-speaking threat actors, and that their similar code suggests shared origins, code reuse, or close collaboration. That assessment describes a criminal language community, not a government program, and no evidence in the reporting ties the marketplace to any state.

What It Changes for Filipino Readers

The templates in these kits impersonate governments, banks and logistics firms, police, healthcare providers, and retailers — in the United States, most Iron Man lures pose as transportation or government offices, and victims also turned up in Japan, Australia, and India. The phishing pages were not typo-ridden spam; they were professionally maintained copies of pages people trust. That is the core shift for any reader who checks spelling to spot a scam: the factory now ships pixel-perfect fakes, so the name or institution printed on a message proves nothing about who sent it.

Philippine readers have already met this threat at street level. The same template logic powers the scam-center supply chain, from compound recruiters to money mules, and the kits’ appetite for bank, government, and delivery-brand skins maps directly onto the channels Filipinos use for remittances, e-wallets, and parcel notices. If a message arrives saying your package is held at customs or your account needs re-verification, treat the brand on the screen as scenery. Verification is a habit, not a logo check: Scamcheck.ph, the free checker that flags suspicious messages before they reach a wallet exist precisely because the realism war is being lost at the eyeball level, never at the infrastructure level.

The regional response is being built for exactly this kind of industrial fraud. the ASEAN trace-and-block strategy is stitching together cross-border takedowns and evidence sharing, and the takedown of a marketplace that served kits across Japan, the United States, and the Philippines shows why the plumbing matters more than the individual scam text. Buyers who used YAM Store could rent the ability to impersonate any institution in 139 countries; the countermeasure is to make that rental market shorter-lived, country by country and platform by platform.

The Enforcement Shift: Why a Lawsuit Broke the YAM Store Machine

No one was arrested on October 14, and that is the point. This was a civil enforcement action — a court-ordered domain takeover in which private plaintiffs, Microsoft and Health-ISAC, petitioned a federal judge and now control the infrastructure. Health-ISAC joined the lawsuit after the kits repeatedly targeted hospitals and healthcare organizations. The partner list reads like a private sector alliance assembled in one room: Japan’s Cybercrime Control Center (JC3), Proofpoint, Resecurity, Cloudflare, Oracle, and blockchain analytics firm TRM Labs, working alongside law enforcement from the National Police Agency tip onward, as Cybersecurity Dive reported.

Why does this matter beyond one marketplace? Because criminal clouds are hard for police to reach but soft for their landlords. When a platform provider is also a plaintiff, the domains do not need raids — they need a court order and a registrar’s cooperation. Microsoft has already disabled more than 20,000 fraudulent accounts tied to the marketplace and blocked tens of thousands of phishing domains; each revocation lands instantly, worldwide, without waiting on extradition.

Microsoft’s own caveat deserves the last word in this section. Masada wrote that the marketplace, CoGUI, and Iron Man are “only part” of a larger criminal network, and that disrupting them makes it harder for criminals to obtain the accounts, tools, and infrastructure they rely on. That is a dent, not a kill: Microsoft on the Issues frames the action as raising criminals’ costs while the broader PhaaS economy persists. Honest expectations now save honest headlines later.

Defense Checklist: What to Do After the YAM Store Takedown

For organizations protecting a Microsoft 365 or Google Workspace tenant, the exposure named in the reporting is tenant hijack: dead organizations’ names snapped up, education licenses quietly assigned, privileged access monetized. The takedown of YAM Store removed one broker, but the hijack patterns live on in other sellers. Hunt for expired organization names your company owns but has let lapse, re-register or defensively park them, and inventory education or trial tenants with the same discipline as production ones. Enforce multi-factor authentication (MFA — a second proof of identity beyond the password) and conditional access policies (rules that block sign-ins from unknown devices or locations), which Microsoft recommends specifically against this kit family, including phishing-resistant MFA for privileged accounts.

Bulk-generated lures are a monitoring target, not just a nuisance. A mailbox that receives template-shaped texts — same layout, rotating brand — should feed your mail security rules and DMARC enforcement (an email standard that lets receivers reject messages spoofing your domain). Microsoft also advises enabling network protection so devices refuse connections to known phishing domains, and watching for device-code phishing, a trick that tricks victims into approving a criminal’s login on a legit Microsoft page.

For individuals, the checklist is shorter and older than the kits: verify the sender inside the official app of the supposed bank or agency instead of tapping the message’s link; never pay through any link a message gives you; assume brand realism is purchasable, because here it was, by subscription; report suspicious texts and emails to your bank, telco, and platform. None of these habits require technical skill, and every one of them beats a template no matter how polished it looks.

The kits may be offline, but the behavior they sold is not. Keep verification where the fakes cannot follow: at the habit level, checking through official channels, costing nothing, refusing to be templated.

What to Watch Next

• Kit variants: treat unlisted kit names as live supply — Proofpoint already tracks companion kits CoAceV and CoFish_ws in the same Chinese-language family, so a new dashboard brand is not a new threat class.
• Iron Man’s post-seizure infrastructure: watch whether its license servers and panels re-emerge on fresh domains; a re-hosted panel within weeks would signal the disruption did not reach the operators’ servers.
• Copycat marketplaces: monitor PhaaS storefronts and YAM Store clones for sub-reseller tiers mimicking the seized model — if a successor marketplace starts advertising the same kit names with fresh payment rails, the dent has begun to refill.

FAQ

What is YAM Store?

YAM Store was an underground, Chinese-language marketplace that sold phishing kits, stolen Microsoft 365 and Azure for Education tenant accounts, licenses, and storage “as a service.” Before its seizure, YAM Store even ran a sub-reseller tier and took cryptocurrency payments (Microsoft). The site tracked as Storm-3119 was an initial access broker — a supplier of footholds that downstream criminals, including kit subscribers, used to send over one billion malicious messages since January 2026.

Is YAM Store linked to the Chinese government?

No public evidence says so, and Microsoft does not claim it. Microsoft assesses with high confidence that the kits sold through YAM Store were developed by Chinese-speaking threat actors, with similar code suggesting shared development origins, code reuse, or close collaboration. That is an assessment about a criminal language community, not a state program, and we keep the distinction exact.

Is phishing-as-a-service still active after the takedown?

Yes — the model, not just this marketplace, persists. Microsoft and partners describe the October 14 seizure of YAM Store infrastructure as a disruption that raises criminals’ costs rather than an elimination of the PhaaS model, and Proofpoint’s researchers had already documented companion kits CoAceV and CoFish_ws in the same family before the seizure.

What should I do if I clicked a link in a phishing message?

Enter nothing, first: if you typed credentials or card details, change the password from the official app, enable MFA on the affected account, and call your bank about the transaction path. If you only clicked, close the page, clear the tab, and report the message to your bank or telco. Speed matters most within the first hour, when stolen credentials are cheapest to reuse.

Why a lawsuit instead of arrests?

Because civil seizure moves at registrar speed: Microsoft and Health-ISAC petitioned the US District Court for the Southern District of Florida and now control the former YAM Store domains, which redirects the checkout pages instantly worldwide. Arrests across borders take years; revoking a criminal’s storefront took an October 7 order and a cooperative alliance of private firms and Japan’s National Police Agency.

How to cite this article: WorldNgayon, “YAM Store Takedown: Microsoft Seizes the Phishing-as-a-Service Empire,” worldngayon.com, October 16, 2026.