Microsoft Dismantles YAM Store Phishing Marketplace and CoGUI Tools

Microsoft led a global operation to dismantle YAM Store, a Chinese-language cybercrime marketplace that facilitated large-scale phishing campaigns. The investigation began after the Japan National Police Agency alerted Microsoft to fraud targeting Japanese businesses and individuals. Researchers discovered the platform sold stolen Microsoft and Google accounts, web hosting, and spoofing tools.

Root cause

The YAM Store enabled threat actors to bypass the technical barriers of creating fraudulent infrastructure. Instead of building custom phishing pages, criminals purchased ready-made solutions. The marketplace offered digital accounts and hosting services alongside software designed to impersonate legitimate entities. This commodification allowed even less skilled actors to launch sophisticated attacks against global organizations.

Attack path

Attackers utilized two primary tools found in the store: CoGUI and Iron Man. CoGUI provided a website building framework that supplied ready-made pages impersonating financial institutions, government agencies, and other trusted organizations. These pages were designed to steal passwords and payment information. Criminals deployed these sites quickly without needing to code them from scratch.

Iron Man later expanded this model by offering a gallery of thousands of templates. This tool allowed attackers to tailor email, text, and web content to specific brands, industries, and countries. According to Microsoft, Iron Man began replacing CoGUI by mid-2026, enabling more targeted and varied phishing campaigns across different regions.

Affected versions

The threat infrastructure targeted users of Microsoft and Google services globally. The phishing templates were designed to impersonate trusted brands across various sectors. Victims in Japan and the United States were primary targets of the CoGUI framework. Iron Man templates were tailored to specific industries and countries, broadening the scope of potential victims to include any organization using standard email or web interfaces.

Mitigation

• Monitor for newly registered domains that mimic trusted brand names or use similar visual designs.
• Verify the authenticity of unsolicited emails requesting credentials or payment information before clicking links.
• Implement strict email authentication policies such as SPF, DKIM, and DMARC to reduce spoofing success.
• Review account activity for unauthorized access, especially if credentials were potentially exposed on underground markets.

Signals worth monitoring

Security teams should monitor for spikes in login failures from unusual geographies or unfamiliar user agents. Check web proxy logs for requests to newly registered domains that mimic corporate branding. Look for email headers indicating spoofed sender addresses or missing authentication records. Investigate any internal reports of phishing emails containing links to generic template-style pages. Contain compromised accounts immediately by resetting credentials and revoking active sessions.

Background: Phishing

Phishing email examples often mimic trusted brands with urgent requests. Look for mismatched sender domains, generic greetings, and links that do not match the display text. Verify the request through a separate channel before clicking any links or downloading attachments.

Read the full guide: Phishing Email Examples: How to Spot the Hidden Traps

What to do and how to stay safe: Microsoft

• Audit your email filtering rules to ensure they block messages containing links to known phishing template generators or suspicious domains.
• Train employees to recognize phishing attempts that use generic but professional-looking templates impersonating well-known brands.
• Monitor your organization's external-facing assets for unauthorized use of your logos or branding in fraudulent communications.
• Once the vendor provides an update, apply patches to any systems that may have been exposed to credential theft via these phishing sites.

Step-by-step guide: Account Takeover Fraud: How Attackers Steal Identities and How You Stop It

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tools were used in this phishing campaign?

The campaign relied on CoGUI, a website building framework, and Iron Man, a template gallery, both sold on the YAM Store.

Who led the takedown of this cybercrime marketplace?

Microsoft led the operation alongside private cybersecurity companies like Proofpoint and law enforcement agencies from Japan.

How many phishing messages were sent?

The operation drove over a billion phishing messages before the domains and thousands of accounts were seized by authorities.