Microsoft and partners dismantle key phishing kit infrastructure of Chinese cybercrime marketplace

LATEST MATERIAL CHANGE

What changed?

Microsoft, in cooperation with Japan’s National Police Agency, cybersecurity firms, and the nonprofit Health‑ISAC, has taken down three critical components of a Chinese‑language cybercrime marketplace that sells phishing kits. The dismantled parts—YAM Store, CoGUI, and Iron Man—were responsible for enabling more than one billion malicious messages sent to over 75,000 organizations worldwide, including 750 million messages aimed at Microsoft customers. The kits provided ready‑made templates that let attackers impersonate a wide range of entities—from government agencies to banks and parcel delivery services—in multiple languages. By removing these infrastructure nodes, Microsoft and its partners have made it harder for criminals to acquire the accounts, tools, and hosting services they need to launch phishing campaigns across more than 150 countries, thereby disrupting a major source of cyber‑crime revenue.

Why it matters

The takedown cuts off a major supply chain for phishing attacks, protecting millions of users and organizations from fraud and data theft while weakening the global cyber‑crime economy.