CryptoSlate
Microsoft and Health-ISAC secured a US court order to seize and redirect domains behind YAM Store, CoGUI, and Iron Man, three phishing-as-a-service vendors that helped criminals send more than one billion malicious messages since January. The operation disabled over 20,000 accounts and is blocking more than 100,000 impersonation and fraud domains used to target 75,000 organizations across 150 countries. YAM Store's storefront accepted USDT on the Tron network alongside Alipay and WeChat Pay, while Cloudflare and blockchain firm TRM Labs helped trace and freeze crypto payments linked to the suppliers.
Why it matters
The takedown is a rare phishing case where the financial plumbing is named in the court filing. YAM Store, CoGUI, and Iron Man were not opportunistic operators but service providers running tiered resale markets for stolen Microsoft and Google accounts, cloud resources, hosting, and ready-made phishing templates. Resecurity identified more than 2,300 Iron Man templates targeting banks, retailers, transport authorities, and government agencies across multiple countries.
The investigation, which began after Japan's National Police Agency flagged scams in late 2025, traced the operation to a Chinese-language marketplace where criminal groups could buy infrastructure without building it themselves. Cloudflare said buyers could also pay with USDC for some marketplace offerings, illustrating how stablecoin rails now serve as a default on-ramp for phishing-as-a-service vendors that need pseudonymous, cross-border settlement.
Market impact
Microsoft said the named vendors were part of a larger criminal network, with related infrastructure still being dismantled. The financial damage is not disclosed. TRM Labs helped locate assets for freezing but did not specify the value seized, so the immediate revenue loss to the operators remains unclear. Cloudflare added that some domain registrars operate in jurisdictions where legal seizures are difficult, meaning replacement infrastructure may emerge even as the named vendors come offline.
For the crypto sector, the read is mixed.
Frequently asked questions
-
What did Microsoft take down in this phishing operation?
Microsoft and Health-ISAC secured a US court order to seize and redirect domains behind three phishing-as-a-service vendors, YAM Store, CoGUI, and Iron Man, that helped criminals send over one billion malicious messages since January.
-
Which crypto assets did the phishing vendors accept?
YAM Store's storefront accepted USDT on the Tron network alongside Alipay and WeChat Pay, while Cloudflare said buyers could also pay with USDC for some marketplace offerings, and the services accepted Ethereum more broadly.
-
How many organizations were targeted by these phishing campaigns?
Since January, the three services helped criminals target more than 75,000 organizations across more than 150 countries, generating tens of millions of dollars for their operators.
-
How was the cryptocurrency funding traced?
Blockchain analytics firm TRM Labs provided intelligence that helped investigators locate assets linked to the group and freeze them, though the company did not disclose the value of the frozen holdings.
-
What infrastructure was disabled as part of the crackdown?
Microsoft disabled more than 20,000 accounts linked to YAM Store, is blocking more than 100,000 impersonation and fraud domains, and worked with Cloudflare to suspend accounts and disable Workers projects supporting the phishing pages.
CoinDesk
CoinTelegraph
TheBlock
WuBlockchain