Microsoft announced the successful disruption of three major phishing platforms operating from China on Wednesday. Working alongside Japan’s National Police Agency and Health-ISAC, the company obtained a U.S. court order to seize and redirect domains associated with YAM Store, CoGUI, and Iron Man. Since January, these platforms collectively sent over 750 million malicious messages to Microsoft customers alone, impersonating more than 75,000 organizations. The campaigns targeted consumers, healthcare organizations, financial institutions, and businesses across more than 150 countries, generating tens of millions of dollars for their operators.
Each platform served distinct functions within the cybercriminal ecosystem. Iron Man operated as a phishing-kit-as-a-service offering more than 2,300 pre-built fraudulent pages, while CoGUI provided ready-made websites and messages impersonating trusted brands and government agencies. YAM Store functioned as a marketplace selling compromised or fraudulently obtained accounts from major technology providers. Through the enforcement action, Microsoft disabled over 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation, while coordinating with international law enforcement partners and cybersecurity firm Resecurity to remove additional infrastructure.
Source: Read the full story at The Record
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
