Microsoft’s Digital Crimes Unit and Health-ISAC, working with Japan’s JC3 and several technology partners, have disrupted three Chinese-language phishing kits and the marketplace that supplied accounts to their users. The kits sent more than one billion phishing emails and text messages this year.
A Court-Authorized Takedown Hits CoGUI, Haozi, Iron Man and YAM Store
The coalition disrupted the CoGUI, Haozi and Iron Man System phishing kits and the YAM Store marketplace. Partners included Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs alongside JC3 and Health-ISAC. Under an order from the US District Court for the Southern District of Florida, the group seized and redirected domains, disabled more than 20,000 YAM Store accounts and blocked more than 100,000 domains.
Reports differ on the exact kit names. One account lists Haozi among the three kits, while another names YAM Store, CoGUI and Iron Man. Separately, more than 17,000 domains were tied to CoGUI, CoAceV and CoFish_Ws, according to one report.
Scale: A Billion Messages to 75,000 Organizations
Since January, the kits drove more than one billion phishing emails and text messages to over 75,000 organizations in more than 150 countries. About 750 million of those were aimed at Microsoft customers, and many used device-code phishing to capture authentication tokens. Health-ISAC says the operators earned tens of millions of dollars. Targets included consumers, healthcare organizations and financial institutions, and the campaigns reached Microsoft 365 and Google Workspace customers.
Storm-3119 and Storm-2990: Who Microsoft Says Ran the Operation
Microsoft tracks the YAM Store marketplace, which acts as an initial access broker, as Storm-3119, and the kit developers as Storm-2990. YAM Store bought expired domains belonging to real nonprofits and schools, rebuilt their websites, and registered Microsoft 365 and Google accounts on them to sell to phishing operators. Some of the fake organizations were generated with AI tools. Reusing a legitimate organization’s domain history gives the phishing infrastructure a reputation advantage over newly registered domains.
How Iron Man’s 2,300 Templates Displaced CoGUI
Iron Man offers more than 2,300 templates that impersonate banks, retailers, delivery firms and government agencies. Resecurity counted 2,360 packages across 130 countries. Its features include geofencing, fake CAPTCHA gates and IP filtering, all designed to hide phishing pages from scanners and security researchers while showing them to intended victims. Iron Man displaced CoGUI as the dominant kit by mid-2026.
From Japanese Targeting to a Global Case
The investigation traces back to late 2024, when Proofpoint observed CoGUI campaigns aimed at Japan. Japan’s National Police Agency alerted Microsoft in late 2025, and Microsoft opened its investigation then. The court-authorized takedown was announced on October 14.
Continuing Disruption and What the Takedown Does Not Settle
Microsoft and its partners say domain seizures, account takedowns and domain blocking will continue as more infrastructure is identified. The announcement does not name arrests or defendants, and it does not say whether the kit developers or YAM Store operators have been located. The action removes infrastructure and accounts, but phishing kits are commodity software that other operators can rebuild.
The coalition’s structure is notable in itself. A health-sector information-sharing group, a Japanese cybercrime center, a cloud network provider, a database vendor, an email security vendor and a blockchain analytics firm each held a different piece of the picture: victim reports, domain data, infrastructure, email telemetry and cryptocurrency flows. Civil takedowns of this kind depend on assembling those pieces quickly enough that a court order can reach the infrastructure before operators migrate it.
The split between kit developers, an access broker and the buyers who run campaigns also shows the division of labor in modern phishing. Removing YAM Store’s 20,000 accounts takes away a supplier that many buyers shared, which may disrupt more campaigns than seizing any single kit’s domains.
