On 14 October, Microsoft announced it had dismantled a sprawling phishing-as-a-service ecosystem together with Japan's National Police Agency and a coalition of partners including Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. At the centre of the operation was YAM Store, an underground marketplace selling compromised Microsoft and Google accounts and infrastructure, which in turn supplied criminal customers with three ready-made phishing kits: CoGUI, Haozi and Iron Man. Together they are linked to more than 1 billion phishing messages sent since the start of the year, with over 750 million aimed specifically at Microsoft 365 account holders. With a seizure order from a US federal court, the coalition took down and redirected the supporting domains, disabled more than 20,000 criminal accounts, and blocked over 100,000 domains built to impersonate legitimate brands.
What made this network effective was how little skill it demanded. Iron Man alone offered subscribers more than 2,300 pre-built lure pages impersonating postal couriers, tax offices, banks and telecom providers, with templates localised for specific countries so a criminal in one region could convincingly target victims in another. Microsoft says the kits were used to impersonate over 75,000 organisations across more than 150 countries, generating an estimated tens of millions of dollars for their operators. CoGUI was reportedly the dominant kit before customers shifted to Iron Man mid-2026 — a reminder that the underlying criminal business model survives even when the specific tools around it get swapped out, and that this takedown disrupts infrastructure rather than eliminating the market behind it.
What this means for your business
If your business runs on Microsoft 365, this network was built specifically to target accounts like yours, and others like it will keep trying. Make sure multi-factor authentication is enforced for every account, not just recommended, since a stolen password alone shouldn't be enough to get in. Remind staff this week that a convincing "tax office," "courier," or "bank" email is no longer a sign of a sophisticated, targeted attack — it's increasingly a rented template available to anyone. Check who is actually sending email on your domain's behalf by reviewing your SPF, DKIM and DMARC records, and if any employee has reused a work password elsewhere or logged in on a shared device recently, treat that as a reason to rotate credentials now rather than wait for a sign of trouble.