Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
Microsoft disrupted three phishing platforms (YAM Store, CoGUI, Iron Man) used by Chinese cybercriminals, seizing domains and redirecting them. The platforms sent over 750 million malicious messages targeting Microsoft customers and others. Microsoft worked with Japanese authorities and Health-ISAC to obtain a U.S. court order. The platforms impersonated 75,000 organizations to steal credentials and personal data. Microsoft also disabled 20,000 accounts linked to YAM Store.
How this was made
The 30-second read
Why it matters
The takedown curtails a major source of credential theft targeting Microsoft 365 users, reinforcing Microsoft’s security narrative.
Market read
First‑report of a coordinated legal takedown of large‑scale phishing infrastructure, potentially positive for Microsoft’s security reputation and the broader cybersecurity market.
What to watch
Potential retaliation from cybercriminal networks or displacement of attacks to other vectors.
Background
Microsoft’s Digital Crimes Unit worked with Japanese authorities to obtain a U.S. court order, seizing domains and disabling thousands of accounts linked to YAM Store, CoGUI and Iron Man phishing platforms.
Ticker impact
Microsoft announced legal action and court order to seize and redirect domains of three major phishing platforms used by Chinese cybercriminals.
likely modest upside as investors view the action as strengthening Microsoft’s security posture
First‑report of a coordinated legal seizure; no direct financial numbers but security wins are generally viewed favorably.
Market effects
May boost confidence in cybersecurity solutions across the tech sector.
Highlights increased cooperation between US, Japan and law enforcement against cybercrime.
Sets a precedent for cross‑border legal actions against phishing infrastructure.
Counterpoint
The action could be seen as a limited tactical win with minimal long‑term revenue impact for Microsoft.
Key entities
- CompanyMicrosoft
US‑listed cloud and software provider executing the legal action.
- Government AgencyJapan National Police Agency
Partnered with Microsoft in the seizure operation.
- OrganizationHealth‑ISAC
Healthcare cybersecurity group that assisted in the investigation.
