Microsoft and the health care industry’s information sharing and analysis center have teamed up to disrupt a prolific China-based phishing ecosystem.
The tech giant and Health-ISAC on Wednesday announced a cooperative effort to dismantle three Chinese-language cybercrime marketplaces: YAM Store, which offered fraudulent Microsoft and Google accounts and identity-theft tools; CoGUI, which sold phishing websites and messages that impersonated governments, banks and tech companies; and Iron Man, which offered thousands of online templates impersonating healthcare firms, retailers, police departments and other organizations.
On Oct. 7, a federal judge in the Southern District of Florida granted Microsoft and Health-ISAC’s request to take control of the cybercrime websites’ domain names, effectively severing their options, at least temporarily.
“Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone,” Steven Masada, associate general counsel and general manager of Microsoft's Digital Crimes Unit, said in a company blog post.
Attackers used the phishing services to target banks, healthcare organizations and consumers in more than 150 countries, Microsoft said.
Broad partnership, ongoing takedown
Microsoft learned about the phishing marketplaces after a late 2025 tip from Japan’s National Police Agency, which soon joined the operation to dismantle them, along with security firms Proofpoint and Resecurity, blockchain intelligence company TRM Labs and tech giants Cloudflare and Oracle.
Health-ISAC provided Microsoft with a picture of how the phishing attacks were affecting healthcare organizations, while the partner companies “contributed intelligence and investigative support,” Masada said in the blog post. The partners used AI tools to supplement human analysis and connect infrastructure that initially seemed unrelated.
Microsoft has already disabled more than 20,000 fraudulent accounts associated with the phishing marketplace, Masada wrote, and the company “continues to dismantle the operation by removing infrastructure hosted on its services” and blocking tens of thousands of phishing domain names.
Microsoft acknowledged that its operation would put only a dent in the broader phishing ecosystem, but Masada wrote that taking down three prolific marketplaces “makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.”
