Microsoft and Proofpoint Disrupt CoGUI Phishing Kit, YAM Store, and Iron Man
Do Son 
TL;DR
Microsoft, Health-ISAC, Proofpoint, and international partners executed a major CoGUI phishing kit takedown alongside connected criminal marketplaces YAM Store and Iron Man. Since January 2026, these platforms enabled over one billion scam messages targeting 75,000 organizations worldwide. Consequently, a federal court order allowed investigators to seize malicious domains and disable more than 20,000 fraudulent accounts.
What Happened in the Operation
On October 14, 2026, Microsoft and Health-ISAC announced a coordinated legal and technical action against three major cybercrime operations. With an order from the U.S. District Court for the Southern District of Florida, the coalition seized and redirected domains powering YAM Store, CoGUI, and Iron Man. Furthermore, Microsoft disabled over 20,000 accounts linked to YAM Store and blocked more than 100,000 fraudulent domains.
The investigation started in late 2025 when Japan’s National Police Agency (NPA) alerted Microsoft to widespread scam campaigns in Japan. Subsequently, the probe expanded to include the Japan Cybercrime Control Center (JC3), Proofpoint, Resecurity, Cloudflare, Oracle, and TRM Labs. “What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation,” Microsoft stated in its report.
Inside the Criminal Marketplace
Investigators uncovered an underground service economy that supplied ready-made fraud tools to global criminals. Specifically, YAM Store functioned like an online retail shop for cybercriminals. Operators bought expired domains belonging to legitimate nonprofits and schools, rebuilt their websites, and registered fraudulent Microsoft 365 and Google Workspace accounts to sell to buyers.
Buyers then paired these accounts with the CoGUI phishing kit to send high-volume email and text lures. By mid-2026, criminals also adopted a newer platform called Iron Man. Through test purchases with Resecurity, investigators found over 2,300 Iron Man templates impersonating banks, delivery firms, and government agencies across 150 countries.
Who Is Behind the Activity
Researchers attribute these tools to a network of Chinese-speaking threat actors and overlapping affiliates. According to Proofpoint Threat Research, the highest-volume email threats targeting Japan stem from three related kits: CoGUI, CoAceV, and CoFish_ws. “Proofpoint assesses with high confidence that all these phishing kits have common roots and are used by overlapping affiliates,” the security firm noted.
Technical analysis confirmed deep connections between the tools. For example, in February 2026, the CoGUI phishing kit introduced a decoy method that redirected automated sandboxes to fake domains like www.a.com. Just days later, CoAceV deployed the exact same decoy technique during simultaneous Apple phishing campaigns. In addition, all three kits shared identical URL structures and paths across roughly 17,000 unique domains.
Impact and Financial Scale
The criminal ecosystem operated at an industrial scale. Microsoft reported that YAM Store, CoGUI, and Iron Man fueled more than one billion malicious messages since January 2026, including 750 million aimed at Microsoft customers. Moreover, these operations allegedly generated tens of millions of dollars for their operators.
Proofpoint blocks over 100 million messages per month originating from the CoGUI phishing kit alone. Across 1,342 tracked campaigns, the three kits impersonated 66 mostly Japanese brands, including Amazon, PayPay, Rakuten, SMBC, and Apple. Financial services and healthcare suffered the heaviest targeting, followed by government, education, and manufacturing. Japanese authorities previously reported that suspects used stolen financial credentials from similar campaigns to purchase Chinese stocks.
How Organizations Can Stay Protected
Although this CoGUI phishing kit takedown creates severe operational friction for threat actors, organizations must remain alert against evolving templates. Because these kits use CAPTCHA challenges and sandbox evasion to hide fake login portals, traditional URL filters may miss newly rotated domains. Therefore, security teams should enforce phishing-resistant multifactor authentication (MFA) across all corporate and financial accounts. Furthermore, organizations managing expired domains should monitor their former web properties to prevent criminals from hijacking their brand identity.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
