From Japanese Scam Texts to a Court-Ordered Takedown: A Timeline of Microsoft’s Strike on Three Phishing Platforms

The fake “your package is delayed” or “unpaid toll” text rarely comes from a lone scammer. On Wednesday, Microsoft announced legal action against three connected services that supply criminals with ready-made phishing sites, messages and accounts. Here is how the story unfolded, in date order.

The timeline is drawn from Jonathan Greig’s report for The Record, with additional figures from Matt Kapko’s coverage at CyberScoop.

Before the takedown

2025: Japanese police spot a pattern

The investigation began last year, when Japan’s National Police Agency flagged messaging campaigns targeting people in Japan. Microsoft and Japanese officials traced them to a Chinese-language cybercrime ecosystem that started with a service called CoGUI, which supplies ready-made websites and messages impersonating trusted brands, agencies and banks.

The trail widens to YAM Store

As investigators tied more scam campaigns to the same infrastructure, they reached YAM Store, which Microsoft describes as a marketplace selling access to compromised or fraudulently obtained accounts at providers such as Microsoft and Google. Buyers could shop by account age, subscription type and environment, such as education or nonprofit, and buy domains that real organizations had let expire. Those rebuilt sites were then used to steal Microsoft 365 passwords, which in turn were sold back on YAM Store.

January 2026 onward: the volume explodes

Since the start of the year, the three platforms together sent more than 750 million messages to Microsoft customers alone, according to The Record. CyberScoop, citing Microsoft, puts the total across the cluster Microsoft tracks as Storm-2990 at more than 1 billion phishing emails and texts, reaching over 75,000 organizations. Targets included healthcare, financial services, logistics and IT, mainly in the United States and Japan. Besides stealing passwords and payment data, the kits abused Microsoft’s device-code sign-in process to grab login tokens.

Mid-2026: criminals move to Iron Man

By the middle of the year, criminals were shifting from CoGUI to Iron Man, a phishing-kit-as-a-service subscription. Security firm Resecurity, which got inside Iron Man’s infrastructure, found 2,360 templates impersonating banks, retailers, healthcare providers, transport authorities, police and government agencies across 130 countries.

The takedown

Wednesday, October 14, 2026: domains seized

Court order: Working with Health-ISAC under a U.S. federal court order, Microsoft seized and redirected domains that powered YAM Store, CoGUI and Iron Man.
Accounts and domains: Microsoft disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
Partners: Japanese police, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs supported the work, and Microsoft shared information with law enforcement.
Still ongoing: Microsoft says it is still removing infrastructure hosted on its own services.

Part of a pattern

The Record notes this follows last month’s action against the EvilTokens platform and a June operation against infrastructure tied to SocGholish, Amadey and StealC malware. Microsoft’s Steven Masada was candid that these three services “are only part of that larger criminal network.”

What this means for your company

A takedown slows criminals down, but similar kits will fill the gap. The habits that protect your team stay the same:

Treat urgent delivery, toll, bank and tax messages as suspect. Go to the organization’s site or app yourself rather than tapping the link.
Block device-code sign-in if you don’t use it. Identity platforms such as Microsoft Entra ID let you restrict it with conditional access.
Use phishing-resistant sign-in. Passkeys and security keys are far harder to steal through a fake page than passwords and codes.
Watch your own expired domains. Old company domains can be bought and reused to impersonate you, so renew or retire them deliberately.

Need help cutting down the phishing that reaches your staff? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.