Microsoft Disrupts Three Phishing Services With Court Order

Microsoft and its partners have disrupted three services linked to a Chinese-language phishing ecosystem, using a federal court order to seize and redirect domains that powered the operations. Microsoft said the services had enabled more than one billion phishing emails and text messages since January 2026, targeting more than 75,000 organizations worldwide. The operation targeted YAM Store, an online marketplace for accounts and infrastructure, and the CoGUI and Iron Man phishing kits. Microsoft said more than 750 million of the messages targeted its customers. The campaigns reached consumers and organizations in more than 150 countries, including those in healthcare and financial services, and generated tens of millions of dollars for the operators, according to Microsoft and Health-ISAC. A federal judge in the Southern District of Florida granted the domain-control request on October 7, according to reporting on the court action. Microsoft said it has disabled more than 20,000 accounts associated with YAM Store and is blocking more than 100,000 domains used for impersonation and fraud. The company said it continues to remove related infrastructure hosted on its services.