Microsoft and Global Law Enforcement Dismantle PhaaS Empire
When our mobile devices receive fraudulent text messages demanding toll payments, package delivery fees, or urgent banking notifications, most of us simply block the sender or delete the message. However, these seemingly sporadic scams conceal a meticulously organized, multinational cybercrime service economy known as Phishing-as-a-Service (PhaaS).
Microsoft Digital Crimes Unit (DCU) and Health-ISAC announced a monumental transnational operation. Authorized by the US District Court for the Southern District of Florida, law enforcement agencies and cybersecurity giants from multiple nations united to dismantle a massive underground marketplace. Operated by Chinese-speaking threat actors, this ecosystem provided global cybercriminals with stolen accounts, fake websites, and phishing templates through platforms such as YAM Store, CoGUI, and Iron Man.
Unveiling a Massive Chinese-Speaking Crime Ecosystem
Codenamed one of the largest phishing infrastructure takedowns in recent history, the operation originated from intelligence shared by the National Police Agency (NPA) of Japan with Microsoft in late 2025. At the time, Japan experienced a relentless wave of malicious SMS and phishing campaigns targeting businesses and consumers.
Initially, investigators suspected common, isolated threat groups. However, multinational tracking unveiled an intricate Chinese-speaking cybercrime market. According to joint data published by Microsoft and security partners like Proofpoint and Resecurity, the destruction wrought by this criminal supply chain between January and October 2026 reached staggering proportions:
- Over One Billion Malicious Messages: The infrastructure facilitated the transmission of more than one billion phishing and scam messages, including 750,000,000 targeted directly at Microsoft customers.
- Victims Across 150 Nations: Attacks affected consumers and organizations in over 150 countries, impacting more than 75,000 enterprises across financial, healthcare, retail, telecommunications, and government sectors.
- Tens of Millions in Illicit Profits: Cybercriminals generated tens of millions of dollars through identity spoofing and credential theft.
Deconstructing the Three Criminal Core Modules
The dismantled underground economy relied on three interoperable modules:
YAM Store (Storm-3119): Initial Access Brokerage
Operating much like a legitimate e-commerce platform, YAM Store allowed criminals to browse products, compare prices, and purchase Microsoft 365 and Google enterprise accounts, licenses, and cloud storage acquired via fraud or exploits. Operated by an individual named Yang Jian, the group utilized automated scraping tools to acquire expired non-profit (.org) and educational (.edu) domains. They forged documents and allegedly leveraged AI to generate fake entities, bypassing security detections to acquire cheap cloud tenants for downstream scammers.
CoGUI (Storm-2990): Turnkey Phishing Portals
Widely utilized until mid-2026, CoGUI provided ready-made phishing websites mimicking major global enterprises such as Amazon, PayPal, MyJCB, Apple, DHL, and Yamato Transport. This enabled low-skilled fraudsters to deploy password-harvesting sites instantly.
Iron Man System (Storm-2990 Derivative): Automated Phishing Framework
By mid-2026, CoGUI gave way to the Iron Man System, a multi-tenant PhaaS platform built on the GoFrame framework. Resecurity and Microsoft penetration testing revealed over 2,335 precise templates tailored for more than 130 countries. Ranging from traffic fines and tax authorities to major banks and courier services, the platform featured geofencing, anti-bot CAPTCHA mechanisms, and seamless Telegram Bot integration. Victims entering credentials triggered instant notifications to scammers, complete with real-time WebSocket page manipulation.
Key Contributions from Proofpoint and TRM Labs
Proofpoint provided vital intelligence revealing that this Chinese-speaking phishing syndicate heavily targeted Japan. Using variants like CoAceV and CoFish_Ws, they dispatched over 100 million phishing emails monthly to Japanese financial institutions. Additionally, cryptocurrency intelligence firm TRM Labs assisted law enforcement in freezing substantial digital assets linked to the syndicate, primarily in USDT and Ethereum.
Microsoft’s Legal and Technical Offensive
Rather than relying on passive defense, Microsoft DCU and Health-ISAC secured civil preliminary injunctions in Florida:
- Domain Seizure and Redirection: Authorities seized and redirected core infrastructure domains including peaceman.cc and aidchildren.cc.
- Mass Account Suspension: Microsoft disabled over 20,000 fraudulent YAM Store accounts and blocked more than 100,000 malicious domains via Microsoft Defender.
- AI-Driven Defense Deployment: Threat intelligence was integrated into Microsoft Defender XDR and Security Copilot to automatically intercept cloud-tenant-based phishing variants.
Ultimately, modern cybercrime operates as a highly industrialized commercial enterprise. Defeating these underground networks requires cross-border intelligence sharing, legal enforcement, and AI-powered tracking to impose severe economic consequences on hidden market operators.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
