TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man, Three Services Behind Global Scam Operations

On October 14, 2026, Microsoft's Digital Crimes Unit and Health-ISAC announced that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man.

Since January 2026, the three services collectively enabled more than 1 billion malicious messages targeting over 75,000 organizations worldwide, according to Microsoft. More than 750 million of those messages were geared toward Microsoft customers. The messages targeted consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, and generated tens of millions of dollars for the operators.

Key takeaways

• Microsoft's Digital Crimes Unit and Health-ISAC are dismantling YAM Store, CoGUI, and Iron Man, three services that supplied criminals with fraudulent accounts, phishing sites, and impersonation templates
• Since January 2026, the services enabled more than 1 billion malicious messages targeting over 75,000 organizations in more than 150 countries, according to Microsoft
• Microsoft's action targets the businesses that supply scam tools, not only the scam messages victims see

{{horizontal-line}}

How the investigation began

The investigation started in late 2025, when Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. Investigators expected to find individual campaigns. Tracing them back led instead to a Chinese-language marketplace where criminals could buy accounts, hosting services, and tools for building fake websites and online identities.

Intelligence from the Japan Cybercrime Control Center (JC3), drawn from its more than 130 member organizations, helped confirm that what looked like separate incidents were part of a broader pattern of scams targeting Japanese companies, financial institutions, and consumers.

Partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs contributed intelligence and investigative support. Microsoft also worked with the US Secret Service and international law enforcement. Working together, the contributors connected accounts, websites, and infrastructure that first appeared unrelated, which exposed the broader marketplace behind them.

TRM's intelligence was key to locating and enabling the freeze of assets associated with the group.

What YAM Store, CoGUI, and Iron Man sold

The three services supplied different parts of the scam supply chain, reflecting a broader trend: modern fraud increasingly relies on businesses and services that make it easier for criminals to reach more victims. YAM Store sold accounts, while CoGUI and Iron Man supplied ready-made impersonation sites and templates.

YAM Store

YAM Store operated like an online shop. Customers could browse products, compare prices, and buy fraudulent Microsoft and Google accounts and other ready-made tools for scams, including credential theft. Controlled purchases by Microsoft confirmed how the store worked.

In some cases, operators bought internet domains that legitimate organizations had let expire, often those of nonprofits and educational institutions. They rebuilt the websites to make the organizations look active, then used them to obtain Microsoft 365 accounts for sale.

CoGUI

CoGUI supplied criminals with ready-made websites and messages impersonating companies, financial institutions, and government agencies. Instead of building fraudulent sites themselves, criminals could deploy pages designed to steal passwords, payment information, and other personal data. CoGUI was one of the most widely used offerings in the ecosystem, particularly against victims in Japan and the United States. By mid-2026, a newer offering called Iron Man was increasingly replacing it.

Iron Man

Iron Man gave criminals access to thousands of ready-made templates impersonating trusted organizations. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, and government agencies across more than 150 countries.

Some templates used the appearance of official authority to pressure victims into paying or disclosing sensitive information. The presence of an organization in these templates does not indicate that its systems were compromised.

Disrupting the suppliers

With an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that were part of the infrastructure powering YAM Store, CoGUI, and Iron Man. As of October 14, 2026, Microsoft has disabled more than 20,000 accounts connected to YAM Store. It continues to dismantle the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.

YAM Store, CoGUI, and Iron Man are one part of a larger criminal network. Disrupting them makes it harder for criminals to obtain the accounts, tools, and infrastructure they rely on.

Microsoft Threat Intelligence has published a blog with more detail on the network and steps customers can take to protect themselves.

{{horizontal-line}}

FAQs

1. What are YAM Store, CoGUI, and Iron Man?

They are three services in a Chinese-language cybercrime marketplace. YAM Store sold fraudulent Microsoft and Google accounts. CoGUI and Iron Man supplied ready-made phishing sites and impersonation templates.

2. What was TRM Labs' role?

TRM Labs contributed intelligence and investigative support to the takedown. TRM's intelligence was key to locating and enabling the freeze of assets associated with the group.

3. Who was involved in the disruption?

Microsoft and Health-ISAC announced the action. Japan's NPA, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs contributed intelligence and investigative support. Microsoft also worked with the US Secret Service and international law enforcement.

4. How many malicious messages did the services enable?

Since January 2026, the services enabled more than 1 billion malicious messages targeting over 75,000 organizations in more than 150 countries, according to Microsoft. More than 750 million were geared toward Microsoft customers.

5. What actions did Microsoft and Health-ISAC take?

With an order from the US District Court for the Southern District of Florida, they seized and redirected domains used by the three services. Microsoft has disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.