The News, Explained
Microsoft announced action with Health-ISAC against the infrastructure of YAM Store, CoGUI and Iron Man on October 14, 2026. The investigation concerns suppliers behind impersonation messages using familiar themes such as missed deliveries or unpaid tolls to prompt clicks, information disclosure or payments. Phishing means posing as a trusted organization or service to obtain information such as passwords or payment details. Source
Microsoft says the investigation began in late 2025 after Japan’s National Police Agency alerted it to malicious messaging activity. JC3, Japan’s cybercrime control center, and several security and technology companies contributed. Health-ISAC is an international nonprofit supporting threat-information sharing and cooperation among healthcare organizations. Microsoft also reports using AI tools to connect accounts, websites and infrastructure; its account describes cross-organization intelligence and investigative work together. Source
What the suppliers provided
| Service | Role described by Microsoft |
|---|---|
| YAM Store | Sold fraudulently obtained Microsoft/Google accounts and tools |
| CoGUI | Supplied impersonation websites and messages |
| Iron Man | Supplied brand-, industry- and country-specific email, text and web templates |
A template is a reusable frame for producing wording or a screen. The ones described here supported impersonation. The reported structure let operators combine elements prepared by suppliers rather than create every account and fake page themselves. Source
Microsoft reports that, since January 2026, the three services enabled over one billion malicious messages targeting more than 75,000 organizations in over 150 countries. More than 750 million messages targeted Microsoft customers. These are the company’s investigation figures, counting messages and targeted organizations separately. Reading them as the number of people who suffered losses would change the unit. Source
Investigators identified more than 2,300 Iron Man impersonation templates, according to Microsoft. They used names of banks, retailers, healthcare providers and government bodies. The source explicitly separates appearance in a template from a confirmed compromise of that organization’s systems. The examples therefore document impersonation targets. Source
Microsoft says an order from the US Southern District of Florida court enabled domain seizure and redirection. A domain is the name used to reach a website. The company reports disabling more than 20,000 YAM-related accounts and continuing disruption by blocking over 100,000 fraud domains and removing infrastructure hosted on its services. Messages, accounts and domains are different counting units. Source
OYOPICK’s Take
The notable approach is to target what repeatedly supplies impersonation, alongside warnings to recipients. Making prepared accounts and fake pages harder to obtain means operators have to replace elements they relied on. If disruption lasts longer than replacement suppliers take to emerge, it could make repeated scams harder to sustain. The lasting effect requires follow-up observation.
Large numbers show the scale of the reported response, but readers also need to know what was counted. Substituting victims for messages, or compromised organizations for impersonation targets, distorts the risk. Microsoft describes these services as part of a larger criminal network. We hope follow-up reporting explains how quickly that supply structure re-forms, helping readers judge the connection between takedown scale and changes they actually experience.