Microsoft Court Order Seizes YAM Store Domains and 20,000 Accounts Linked to 750 Million Phishing Messages

Microsoft executed the disruption in coordination with Japan’s National Police Agency and Health-ISAC, redirecting domains that hosted lure pages for credential theft targeting Microsoft 365, banks and government services in 150 countries. The action also blocked over 100,000 impersonation domains and removed infrastructure hosted on Microsoft services. Iron Man alone offered 2,300 pre-built templates while YAM Store functioned as an initial-access broker marketplace selling aged Microsoft and Google accounts plus expired organizational domains.

Investigation records show the three platforms shared backend infrastructure and developer patterns, indicating either common operators or direct code reuse rather than independent actors. Japanese police tracing began with campaigns against local targets and expanded to reveal CoGUI-to-Iron Man migration mid-2024. YAM Store listings explicitly priced accounts by age, subscription tier and .edu/.org affiliation, creating a direct pipeline from credential theft to resale for further abuse.

The takedown highlights the hybrid criminal model where phishing kits feed initial-access brokers, yet Microsoft’s legal route leaves operators free to shift to non-U.S. providers or encrypted channels. Resecurity infiltration data and court filings confirm the platforms generated tens of millions in revenue but do not establish state sponsorship; the activity aligns with profit-driven Chinese-language cybercrime clusters.

Operators are expected to reconstitute similar services within weeks using alternative registrars. Microsoft stated it continues account remediation and will share indicators with additional law enforcement partners.