{"id":749270,"date":"2026-10-18T10:15:23","date_gmt":"2026-10-18T07:15:23","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/microsoft-disrupts-chinese-language-phishing-kits-behind-1bn-scam-messages\/"},"modified":"2026-10-18T10:15:23","modified_gmt":"2026-10-18T07:15:23","slug":"microsoft-disrupts-chinese-language-phishing-kits-behind-1bn-scam-messages","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/microsoft-disrupts-chinese-language-phishing-kits-behind-1bn-scam-messages\/","title":{"rendered":"Microsoft disrupts Chinese-language phishing kits behind 1bn scam messages"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af2ac6e61829\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af2ac6e61829\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/microsoft-disrupts-chinese-language-phishing-kits-behind-1bn-scam-messages\/#A_trail_that_started_in_Japan\" >A trail that started in Japan<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/microsoft-disrupts-chinese-language-phishing-kits-behind-1bn-scam-messages\/#A_shop_for_scammers\" >A shop for scammers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/microsoft-disrupts-chinese-language-phishing-kits-behind-1bn-scam-messages\/#The_takedown\" >The takedown<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/10\/microsoft-logo-office-building-curved-facade.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>Microsoft and Health-ISAC have seized and redirected domains behind three Chinese-language cybercrime services, YAM Store, CoGUI and Iron Man, Microsoft <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2026\/10\/14\/disrupting-the-service-economy-behind-transnational-cybercrime-operations\/\" target=\"_blank\" rel=\"nofollow noopener\">said on Wednesday<\/a>. Since January 2026, the three services enabled more than 1bn malicious messages targeting over 75,000 organisations worldwide.<\/p>\n<p>More than 750 million of those messages targeted Microsoft customers, the company said. They targeted consumers, healthcare groups, banks and other businesses in more than 150 countries. They generated tens of millions of dollars for the services\u2019 operators.<\/p>\n<blockquote>\n<p>\u201cWhat <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.\u201d Steven Masada, <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/general\/\" data-internallinksmanager029f6b8e52c=\"3\" title=\"General\" target=\"_blank\" rel=\"noopener\">general<\/a> manager of Microsoft\u2019s Digital Crimes Unit<\/p>\n<\/blockquote>\n<h2><span class=\"ez-toc-section\" id=\"A_trail_that_started_in_Japan\"><\/span>A trail that started in Japan<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The investigation began in late 2025, after Japan\u2019s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. It expanded to involve the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft also shared intelligence with the US Secret Service and international law enforcement partners.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"A_shop_for_scammers\"><\/span>A shop for scammers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>YAM Store operated much like an online shop, Microsoft said. Customers could browse and compare prices. They could buy fraudulent Microsoft and Google accounts and ready-made scam tools. In some cases, its operators acquired domains that nonprofits and schools had let expire. They rebuilt the websites to get Microsoft 365 accounts to sell. The store accepted payment through Alipay, WeChat Pay and USDT, according to <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/10\/14\/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime\/\" target=\"_blank\" rel=\"nofollow noopener\">Microsoft Threat Intelligence<\/a>.<\/p>\n<p>CoGUI supplied criminals with ready-made websites and messages impersonating trusted organisations. By mid-2026, a newer offering called Iron Man was increasingly replacing it. Investigators identified more than 2,300 Iron Man templates impersonating banks, retailers, healthcare providers, police departments and government agencies. Most of its US lures concerned transport or government matters, such as traffic and parking fees, Microsoft said.<\/p>\n<p>Chinese-speaking threat actors developed the kits, Microsoft assesses with high confidence. Criminals used them to steal passwords and payment data. The aim was to buy high-end goods, or make transactions on financial platforms, with the stolen data.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_takedown\"><\/span>The takedown<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Microsoft and Health-ISAC acted under an order from the US District Court for the Southern District of Florida. Microsoft has disabled more than 20,000 accounts connected to YAM Store. It is also blocking more than 100,000 domains used for impersonation and fraud.<\/p>\n<blockquote>\n<p>\u201cYAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.\u201d Steven Masada, Microsoft<\/p>\n<\/blockquote><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/microsoft-yam-store-cogui-iron-man-phishing-kits-1bn-messages\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft and Health-ISAC have seized and redirected domains behind three Chinese-language cybercrime services, YAM Store, CoGUI and Iron Man, Microsoft said on Wednesday. Since January 2026, the three services enabled more than 1bn malicious messages targeting over 75,000 organisations worldwide. More than 750 million of those messages targeted Microsoft customers, the company said. They targeted&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-749270","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/749270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=749270"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/749270\/revisions"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=749270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=749270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=749270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}