Microsoft & H-ISAC Dismantle 3 Chinese Scam Stores Targeting 75,000 Entities in 150 Nations

In one of the most sweeping coordinated strikes against transnational cyber syndicates to date, technology giant Microsoft alongside the Health Information Sharing and Analysis Center (H-ISAC) has seized and neutralized the digital infrastructure of three prolific cybercrime marketplaces based in China. Operating under the trade names YAM Store, CoGUI, and Iron Man, the illicit networks functioned as turnkey cybercrime-as-a-service hubs, selling automated phishing toolkits, spoofed public sector portals, and stolen authentication credentials. Following emergency warrants granted by a US federal court, international cyber defense teams severed the technical pipelines of the syndicates, which had targeted more than 75,000 corporate, healthcare, government, and banking entities across 150 countries.

Billion-Message Blitz: How Syndicates Targeted Global Critical Infrastructure

Digital forensics revealed an industrial scale of operations aimed at exploiting corporate and institutional systems:

• Massive Malicious Volume: Forensic telemetry confirmed that since January alone, the three criminal storefronts pumped out over one billion deceptive messages worldwide, with more than 750 million fraudulent delivery attempts directly targeting Microsoft account holders.

• Widespread Institutional Infiltration: The campaigns targeted over 75,000 high-value organizations spanning government agencies, healthcare networks, pharmaceutical researchers, private corporations, and multinational commercial banks.

• Turnkey Cybercrime Marketplace: Operating like standard e-commerce platforms, the stores democratized advanced cyber fraud by retailing ready-to-deploy phishing templates, clone scripts, hosting solutions, and compromised user databases to low-skilled cybercriminals worldwide.

Investigation Unfolded: Japan Police Tip-off Triggers Multi-Agency Crackdown

The collaborative legal and technical takedown stemmed from an international intelligence trail initialized across Asia:

• Early Warnings in Late 2025: The investigation gained traction when the National Police Agency of Japan notified Microsoft of an anomalous surge in sophisticated credential-harvesting campaigns compromising Japanese domestic systems.

• Coalition of Public and Private Forces: The operation rapidly broadened into a multinational counter-offensive uniting the US Secret Service, the Japan Cybercrime Control Center (JC3), and private cloud security providers including Cloudflare and Oracle.

• Exposing the Infrastructure: Technical analysts mapped out extensive server topologies, discovering that operators used Chinese domestic payment channels alongside cryptocurrencies to monetize illicit sales.

Modus Operandi: Spoofed Municipal Fines and Cryptocurrency Laundering

The syndicates engineered hyper-realistic lures designed to siphon financial data and corporate logins:

• Deceptive Public Impersonation: Threat groups running CoGUI and Iron Man engineered deceptive websites and automated notification feeds that precisely mirrored official interfaces of police headquarters, municipal departments, regional hospitals, and tier-one commercial banks.

• Traffic and Parking Fine Scams: Across the United States, citizens were systematically baited with fraudulent text messages and emails alleging unpaid parking tickets and traffic violations, driving victims to lookalike payment gateways that harvested credit card numbers and banking credentials.

• Financial Transaction Rails: Operators handled purchase transactions for their illicit toolkits using platforms such as WeChat Pay and Alipay, while converting international proceeds into stablecoins such as Tether (USDT) to evade financial tracking.

Court-Authorized Takedown: 100,000 Domains Blocked and 20,000 Accounts Severed

The federal legal injunction enabled Microsoft's Digital Crimes Unit to execute decisive technical disruptions across global internet routing architectures:

• Massive Domain Seizures: Acting on US court authorizations, engineering teams instituted active technical sinkholes and domain name system (DNS) blocks on more than 100,000 malicious web domains utilized by the fraudsters.

• Account Terminations: Security teams permanently deactivated over 20,000 accounts directly tethered to the operations of YAM Store and its affiliate distributor networks.

• Sustained Threat Monitoring: Microsoft and H-ISAC affirmed that ongoing telemetry surveillance will track affiliate spinoffs, ensuring persistent enforcement actions to dismantle copycat platforms across the international cybercrime landscape.