A fake parcel alert can begin far from the person who receives it—with a criminal buying a cloud account and a ready-made impersonation page. On October 14, Microsoft and Health-ISAC announced action against YAM Store, CoGUI and Iron Man, a supply network Microsoft says enabled more than one billion malicious messages since January 2026. The operation targeted the businesses supplying scams, including fraudulent or compromised Microsoft and Google accounts. [1]
Microsoft says it has disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud. Those figures describe infrastructure and messages—not a billion victims, 75,000 confirmed breaches, or money returned to affected people. For someone facing an urgent delivery fee or sign-in request, the practical lesson remains: check the supposed problem through the company’s own app or a contact you already trust.
A trail of Japanese scam messages led to an online shop
The investigation began in late 2025, after Japan’s National Police Agency alerted Microsoft to campaigns targeting people in Japan. Information from the Japan Cybercrime Control Center and other partners connected apparently separate scams to common suppliers. Microsoft then conducted controlled purchases to establish what those suppliers were selling.
YAM Store looked like a marketplace: customers could browse accounts, compare offerings and buy infrastructure. The discovery explains why blocking one fake delivery message does little to stop the next one. The sender does not need to build a convincing website, obtain hosting and acquire accounts independently. Different businesses supply those parts.
Microsoft tracks the infrastructure broker as Storm-3119. It groups the developers and activity behind CoGUI, Haozi—also called Phoenix—and Iron Man System as Storm-2990. Chinese-language sales channels and development evidence support Microsoft’s assessment of Chinese-speaking developers; they do not establish that every customer belongs to one group or is state-directed. [2]
An expired organization could become a fresh source of accounts
One procurement route exploited an organization’s abandoned identity. Operators acquired expired domains, rebuilt websites to make the organizations appear active, and used that appearance to obtain Microsoft 365 accounts fraudulently. Education and nonprofit environments were among the offerings. A familiar cloud provider or an organization-like domain could therefore sit behind criminal infrastructure without that provider endorsing the message.
A separate route involved taking over existing cloud environments. Microsoft describes administrative panels that used stolen application credentials to control compromised Microsoft 365 tenants. A tenant is an organization’s cloud environment; an application credential lets software authenticate without a person signing in each time. The panels could reset passwords, allocate education licenses and administer directory information.
That distinction matters during recovery. Access attached to an application is different from an intruder’s browser session. Changing one user’s password cannot be assumed to remove every application credential or permission an attacker has established. In another observed stage, the operator used a compromised Global Administrator account to grant a service principal broad permissions and turn SharePoint and OneDrive storage into a product for resale.
The supply chain continued through a DNS-management platform for phishing domains, certificates and routing, then an automated storefront with a reseller tier. Microsoft also observed fabricated organizations supported by websites and documents. Some supporting content was assessed as likely AI-generated; that is an attributed assessment, not proof that AI caused every takeover.
Iron Man turned the infrastructure into local-looking traps
Buying accounts supplied the foundation. Subscription phishing kits supplied the façade: pages and messages impersonating banks, delivery companies, government agencies and other familiar services. Microsoft’s technical report counted more than 2,335 Iron Man templates tailored to more than 139 countries. Template inventories and coverage figures vary between the investigation’s publications; they are not counts of compromised brands or successful attacks.
A parcel lure in the report claims that a delivery has encountered a problem, asks the recipient to enter an Amazon Shipping portal, and threatens a return if a deadline is missed. Its generic greeting and delivery vocabulary make the request recognizable, while a button moves the reader toward an unrelated site. The brand in the lure does not show that Amazon was breached.
Example
Sender display name: Amazon Shipping Support
Illustrative sender: shipping [at] example [dot] invalid
Subject: Delivery needs your attention
Message: Your parcel cannot be delivered until you confirm its details. Open the shipping portal to arrange another delivery.
Button: Resolve delivery issue
Pressure: Act before the delivery deadline.
This example simplifies the parcel pretext shown in Microsoft’s investigation. The sender and subject above are illustrative, rather than verified headers from the original message.
The kit’s next stage is more interactive than a static counterfeit form. Microsoft describes WebSocket communication that lets an operator follow a visitor’s progress, receive Telegram notifications when credentials or card details are submitted, and choose what the visitor sees next. A fresh request for another code can be part of a person steering the fraud live, as in other interactive phishing checkout systems.
Country filters, IP filtering and fake CAPTCHA gates can hide the page from researchers while admitting intended targets. A CAPTCHA therefore establishes no legitimacy. Downstream campaigns also used device-code phishing, where a victim authenticates through a legitimate service but authorizes access the attacker wants. The application and permissions being approved matter alongside the address of the sign-in service.
What the disruption changes—and what an exposed user should do
Microsoft and Health-ISAC obtained a federal court order to seize and redirect domains supporting YAM Store, CoGUI and Iron Man. Cloudflare separately confirms that it placed warning pages over the shop, disabled Workers projects and suspended accounts in mid-October. Domain redirection and removal of hosting interrupt the suppliers’ operations; they do not recall payment details or access tokens already stolen. The civil action is not a criminal conviction. [3]
If you only received a message, verify the delivery, toll or account issue independently and report the lure. A domain reputation check can add context before visiting an unfamiliar link, but a clean result cannot authenticate a payment demand or an application-consent request. If you entered a password or approved access, use the real service to change the exposed password, review sessions and revoke unrecognized app access; tell your organization’s administrator when a work account is involved. If you supplied card details, contact the card issuer promptly through a known number.
For administrators investigating a compromised tenant, Microsoft’s findings make application secrets, service principals, privileged role assignments and storage access part of the scope—not merely the last suspicious user login. Preserve the relevant logs while containing access. The important result of this investigation is the connection between the visible scam and its suppliers: disrupting the shop raises the attackers’ costs, while careful account recovery addresses access that may already have escaped it.
References
- Steven Masada, Microsoft Digital Crimes Unit. “Disrupting the service economy behind transnational cybercrime operations.” Microsoft, October 14, 2026. Investigation and disruption announcement.
- Microsoft Threat Intelligence and Digital Crimes Unit. “The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime.” October 14, 2026. Technical investigation.
- Cloudflare Cloudforce One. “Cloudflare participates in global operation to disrupt the yam.ink illicit access shop.” October 14, 2026. Infrastructure enforcement report.
