Microsoft and Partners Dismantle Chinese Phishing Network Behind One Billion Fraudulent Messages

A sprawling Chinese-language cybercrime network that routed more than one billion fraudulent messages to targets worldwide has been dismantled following a coordinated legal and technical strike. Microsoft, operating alongside international law enforcement and healthcare security groups, seized control of the infrastructure powering three major phishing platforms on Wednesday.[1][2][3]

The disruption severs access for thousands of cybercriminals who relied on the ecosystem to bypass modern authentication defenses. By taking over the domain names and servers that hosted the operation, investigators have effectively blinded a supply chain that targeted organizations across more than 150 countries since January.[5][6]

The takedown centers on an underground marketplace known as YAM Store, which operated as a wholesale supplier for digital fraud. The storefront sold fraudulently obtained Microsoft and Google cloud accounts, providing attackers with legitimate infrastructure to launch their campaigns without triggering automated spam filters.[6][7]

Dismantling the supply chain

Court orders issued by the U.S. District Court for the Southern District of Florida authorized the seizure of half a dozen top-level domains. The legal maneuver allowed Microsoft and the Health-ISAC to sinkhole the traffic, cutting off the command servers that managed the automated phishing kits.[2][3]

Alongside the YAM Store marketplace, the operation neutralized two specialized phishing-as-a-service platforms known as CoGUI and Iron Man. These kits provided subscribers with ready-made templates designed to impersonate banks, government agencies, and healthcare providers, lowering the technical barrier for entry-level criminals.[4][8]

The scale of the disrupted infrastructure reflects a highly industrialized approach to credential theft. Microsoft reported that it has already disabled more than 20,000 fraudulent accounts connected to the marketplace, while blocking nearly 100,000 domains that were actively used for impersonation and fraud.[1][5]

The phishing kits collectively enabled an estimated 750 million malicious messages directed specifically at Microsoft customers. The remaining volume targeted a broad spectrum of global corporations, with a particular focus on healthcare facilities, financial services, and wholesale distribution networks.[2][6]

The Japanese connection

The investigation began in late 2025 after the Japanese National Police Agency alerted Microsoft to a surge in sophisticated messaging campaigns. What initially appeared to be an isolated phishing kit soon revealed a much larger, interconnected ecosystem operating primarily in Chinese.[5][8]

Threat actors utilized the platforms to target organizations heavily in Japan, the United States, Australia, and India. The lures frequently focused on localized administrative issues, sending victims fake notifications about unpaid traffic fines, parcel delivery failures, and urgent banking alerts.[1][8]

To unravel the network, investigators deployed artificial intelligence tools to map relationships between seemingly disparate servers and accounts. Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit, noted that this automated analysis was crucial in exposing the broader criminal marketplace behind the individual attacks.[3][5]

The collaborative effort ultimately involved intelligence sharing across multiple private security firms, including Proofpoint, Cloudflare, Oracle, and TRM Labs. This coalition approach allowed defenders to track the operation's financial flows and infrastructure footprint across different cloud environments.[4][6]

How the ecosystem operated

The YAM Store operators relied on a five-stage attack pipeline that began with automated reconnaissance. The group used lightweight Python scripts to scan the internet for expired domains previously owned by legitimate organizations, which they would then register and rebuild.[6][7]

By resurrecting these trusted domains, the operators could fraudulently acquire Microsoft 365 and Azure cloud accounts under the guise of established businesses. These compromised environments were then packaged and sold to downstream attackers, complete with the necessary licenses and storage capacity.[1][6]

The marketplace offered a tiered subscription model, allowing buyers to select infrastructure based on domain age and specific environment types. Criminals could specifically purchase access to educational or non-profit tenants, which often benefit from less restrictive security filtering.[6][7]

According to court filings, one of the primary operators of the YAM Store, identified as Yang Jian, managed the procurement and resale of the fraudulent cloud accounts. The legal complaint alleges that this operation generated tens of millions of dollars in illicit revenue by supplying the broader cybercrime community.[2][3]

The backend infrastructure of the phishing platforms relied on a complex mix of PHP, Java, and Cloudflare Workers to maintain persistence. This architecture allowed the operators to rapidly shift their hosting environments when specific servers were flagged by security vendors, ensuring continuous service for their criminal subscribers.[6][7]

Once deployed, the CoGUI and Iron Man kits automated the process of stealing login credentials and session tokens. The platforms were specifically designed to bypass multi-factor authentication, capturing the necessary data to grant attackers persistent access to enterprise networks.[4][8]

The economic impact

The disruption targets the service economy that makes modern cybercrime profitable, rather than just blocking the resulting spam. By dismantling the wholesale suppliers, defenders force individual threat actors to rebuild their own infrastructure, significantly increasing their operational costs.[5]

The financial damages prevented by the takedown are difficult to quantify, but the targeted sectors represent some of the most sensitive data environments globally. The involvement of the Health-ISAC highlights the severe risk these phishing campaigns posed to medical facilities, where compromised credentials often lead to ransomware deployment.[2][3]

While the seizure of the YAM Store domains represents a major tactical victory, security researchers anticipate that the operators will eventually attempt to rebuild. However, the intelligence gathered during the operation provides defenders with a detailed map of the group's tactics, complicating their path to recovery.[1][5]

The disruption also highlights the growing trend of phishing-as-a-service, where technical expertise is no longer required to launch devastating attacks. By commoditizing the infrastructure, the YAM Store enabled a massive volume of low-skilled actors to execute campaigns that previously required dedicated development teams.[4][6]

The Japanese Cybercrime Countermeasures Center played a pivotal role in tracing the localized lures back to the central Chinese-language platforms. Their analysis of the initial text message campaigns provided the critical technical indicators that allowed Microsoft to map the full extent of the Storm-3119 threat group.[5][8]