Microsoft Disrupts Three Phishing Platforms Behind Hundreds of Millions of Scam Messages

Microsoft has announced legal action against three phishing platforms known as YAM Store, CoGUI and Iron Man. Working with Japan's National Police Agency and healthcare security group Health-ISAC, it obtained a US court order to seize and redirect domains that were part of their infrastructure. Since January, the platforms enabled more than 750 million messages aimed at Microsoft customers alone, impersonating over 75,000 organisations in more than 150 countries and earning their operators tens of millions of dollars.

Iron Man is a phishing-kit-as-a-service: criminals buy a subscription and get more than 2,300 ready-made fake pages posing as postal companies, traffic fine offices, tax agencies, banks and telecoms. Templates are tailored for Australia, Japan, India and dozens of other countries. CoGUI offers similar ready-made websites and messages, and was heavily used against people in Japan before criminals began shifting to Iron Man. Most of the tools aim to steal credentials, personal information and banking details.

Microsoft's Digital Crimes Unit said the investigation began last year, when Japanese police flagged scam campaigns targeting people in Japan. These were traced to a Chinese-language cybercrime ecosystem that started with CoGUI and expanded, and linking multiple campaigns to the same infrastructure led investigators to YAM Store. This summary covers only the opening of the original report.