Chinese-Language Phishing Services Sent 1 Billion Malicious Messages in 2026
On October 14, 2026, it was reported that a network of highly sophisticated Chinese-language phishing websites, utilized by cybercriminals to impersonate global corporations, had its infrastructure dismantled following a U.S. court order. This significant action was initiated by Microsoft in collaboration with Health-ISAC, a healthcare organization, reflecting growing concerns about the rampant use of phishing tactics across the globe.
The U.S. District Court for the Southern District of Florida approved the disruption of three major phishing platforms linked to Chinese cybercriminals, which were responsible for sending in excess of a staggering one billion malicious emails and texts. The order specifically targeted multiple top-level domains associated with the phishing services known as YAM Store, CoGUI, and Iron Man. It directed infrastructure providers to disable the associated computers and servers that were instrumental in the operation of these illicit phishing services.
This intricate and interconnected network of phishing kit operators and developers constituted a marketplace that sold tools and infrastructure vital for executing large-scale campaigns. The threat actors primarily targeted sectors such as healthcare, financial services, wholesale distribution, and information technology, with victims located across Asia, the Americas, and Australia. These coordinated efforts generated tens of millions of dollars in illegal profits for the cybercriminals.
An extensive investigation spearheaded by international law enforcement agencies, including Japan’s National Police Agency and their Cybercrime Countermeasures Center, alongside U.S. security firms such as Resecurity, Cloudflare, Oracle, and Proofpoint, led to the unearthing of this expansive phishing enterprise. Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit, emphasized the efficacy of collaborative efforts. With the help of artificial intelligence tools, investigators were able to connect various accounts, websites, and layers of infrastructure that initially seemed unrelated, thus exposing the much larger criminal marketplace underpinning these operations.
The roots of this investigation traced back to late 2025 when Microsoft was alerted by the Japanese police about escalating malicious messaging campaigns. What began as scrutiny of a single phishing kit soon unfolded into a more comprehensive investigation revealing an intricate ecosystem revolving around the underground marketplace identified as YAM Store.
Microsoft elaborated on the diverse offerings within the YAM Store, describing it as a hub available to cybercriminals that provided various infrastructures based on age, subscription types, and the nature of the environment—such as educational or non-profit entities. Pricing for these fraudulent tools ranged widely from approximately $40 to $300, allowing customers to browse products, contrast prices, and make purchases for tools designed for scams.
Particularly noteworthy is the Iron Man System, which hosts an impressive catalog of over 2,335 phishing templates tailored to exploit over 139 countries. Many of these templates are designed to mimic reputable brands, including authorities in traffic and parking alongside organizations within the law enforcement, healthcare, finance, transportation, and retail sectors. The system also boasts sophisticated evasion techniques, including the employment of fake CAPTCHA gateways to ward off automated scripts and geofencing measures to limit access only to users from specified countries.
Upon luring unsuspecting victims into their traps, these phishing kits glean sensitive information through a communication protocol called WebSocket. This method facilitates real-time interaction with victims via Telegram notifications, thus enhancing the cybercriminals’ capabilities.
One of the operators linked to YAM Store, identified as Yang Jian, is accused of acquiring and reselling fraudulent Microsoft and Google cloud accounts. The operational methods of YAM Store involved reconstructing expired websites that previously belonged to legitimate businesses, thus reviving them to appear legitimate again and subsequently securing Microsoft 365 and Azure accounts for resale.
Cybercriminals exploited these fraudulent accounts in tandem with Chinese-language phishing toolkits like CoGUI and Iron Man, primarily to pilfer login credentials and perpetrate financial fraud. Notably, a complaint filed by Microsoft and Health-ISAC revealed the gravity of these phishing operations, stating that one member of Health-ISAC experienced an intrusion into its secured systems after a staff member inadvertently engaged with a phishing email stemming from the CoGUI toolkit.
The YAM Store’s operational model follows a systematic five-stage attack pipeline. Initially, it employs a lightweight web framework called Flask for reconnaissance, stealthily identifying and profiling organizations that are cloud-enabled. The automation tools permit the identification of Microsoft 365 tenants and facilitate the gathering of licensing and Azure cloud data.
In executing compromised environments, the cybercriminals manage operations from their own platforms, developed using PHP, Java/Spring, and Cloudflare Workers. This strategic implementation allows them to sustain, monetize, and expand access through stolen credentials, maintaining a degree of persistence that is typically more durable and harder to detect.
In conclusion, the recent disruption of this elaborate phishing network is a testament to the importance of international collaboration in combating cybercrime. The proactive measures taken by Microsoft and its partners exemplify a growing awareness of the need to address the ever-evolving landscape of cyber threats, particularly those leveraging social engineering tactics to exploit businesses and individuals across the globe. As cybercriminals continue to innovate in their methods, ongoing vigilance and comprehensive cybersecurity measures remain crucial to safeguarding sensitive information and maintaining trust in digital communications.