MICROSOFT , Health-ISAC, Proofpoint and international partners on 14 October 2026 announced a coordinated takedown targeting the CoGUI phishing kit, along with its connected marketplaces YAM Store and Iron Man. Citing a U.S. District Court for the Southern District of Florida order, investigators seized malicious domains and redirected traffic, disabled more than 20,000 associated accounts, and blocked over 100,000 fraudulent domains.
The operation, which began with a Japan-focused alert from the National Police Agency in late 2025, expanded to involve JC3, Resecurity, Cloudflare, Oracle and TRM Labs, reflecting a transnational effort to disrupt a large-scale phishing ecosystem.
The evidence presented portrays an underground service economy supplying ready-made fraud tooling to criminals. YAM Store acted as a stockroom for compromised domains and fraudulent Microsoft 365 and Google Workspace accounts, which attackers paired with the CoGUI phishing kit to mass-distribute lures via email and SMS.
Investigators also identified Iron Man as a newer platform used for phishing templates—more than 2,300 templates impersonating banks, delivery firms and government agencies were observed across 150 countries. The operation disrupted campaigns that had generated over one billion messages since January 2026, including around 750 million aimed at Microsoft customers, and it is noted that victims included organisations across financial services, healthcare and other sectors.
In response, Microsoft and partners urge continued vigilance against evolving phishing templates that abuse CAPTCHA challenges and sandbox evasion, with a push for phishing-resistant MFA and monitoring of expired domains to protect brand identity.