- Microsoft helped dismantle a cybercrime marketplace that sold phishing tools, accounts, and scam infrastructure
- Platforms CoGUI and Iron Man enabled large-scale phishing campaigns targeting organizations worldwide
- The operation drove over a billion phishing messages before domains and thousands of accounts were seized
Late last year, Microsoft set out to investigate what seemed to be yet another phishing campaign.
However, what it uncovered under the surface was a lot bigger - it was a sprawling Chinese-language cybercrime marketplace where countless threat actors bought, traded, and sold digital accounts, web hosting services, as well as different tools needed to create spoofed websites and fake identities.
The company has now revealed how it led the move to dismantle the marketplace, together with private cybersecurity companies including Proofpoint, and law enforcement agencies from Japan.
YAM Store, CoGUI, and Iron Man
The investigation began after Japan’s National Police Agency (NPA) tipped Microsoft off about a wave of fraud and scam activity targeting both individuals and businesses in the country.
The researchers uncovered a major underground marketplace called YAM Store, where they saw fraudulent Microsoft and Google accounts being offered for sale, as well as different ready-made tools for carrying out scams, including credential theft.
In the store, two specific tools stood out: CoGUI, and Iron Man. The former seems to be a website building framework, while the latter - a template gallery.
“CoGUI supplied criminals with ready-made websites and messages impersonating companies, financial institutions, government agencies, and other trusted organizations,” Microsoft explained. “Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”
According to the researchers, CoGUI became one of the most widely used offerings in the ecosystem, primarily for targeting victims in Japan and the United States. However, by mid-2026 it was steadily being replaced by Iron Man:
“Iron Man expanded the model by giving criminals access to thousands of ready-made templates designed to impersonate trusted organizations,” the researchers said. “Criminals could then quickly deploy email, text and web content tailored to specific brands, industries and countries.”
Microsoft said the tool offered more than 2,300 templates of different banks, retailers, healthcare providers, police departments, and other organizations, found in more than 150 countries around the world.
The store, and its offerings, were very popular in the cybercriminal community. Just this year, they facilitated more than a billion phishing messages being aimed at 75,000 organizations around the world. Microsoft customers alone received more than 750 million of these messages since the start of the year.
These attacks translated to “tens of millions of dollars” in profit for the operators.
Dismantling the operation
The network is now being torn down, Microsoft said. After receiving the order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC (a global non-profit helping healthcare firms share cyber intelligence) seized and redirected the domains leading to YAM Store, CoGUI, and Iron Man. At the same time, Microsoft disabled more than 20,000 accounts connected to the store and “continues to dismantle the operation by removing infrastructure hosted on its services.”
So far, the action has blocked more than 100,000 domains used for both impersonation, and fraud.
“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world,” the researchers concluded.
“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.”
While tearing down the infrastructure is commendable, without arrests chances are the marketplace will re-emerge sooner or later. For example, when law enforcement agencies took down two major platforms Cracked and Nulled early in 2025, they arrested two suspects, and seized 17 servers and more than 50 electronic devices.
Cracked and Nulled, forums that offered illegal goods and cybercrime-as-a-service, counted more than 10 million users in total, and investigators estimated the arrested suspects earned more than a million dollars in criminal profits.
➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.