[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO7i2GJq_4a9Hd60vPFJW2NjfDEj9dMiz7keyxR0nxbo":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"9ffa0a6c-62f3-44d3-aeda-b1de9ffb7b39","Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages","microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages-69760c","Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man. The post Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages appeared first on SecurityWeek.","Microsoft, with the help of Health-ISAC and a federal court order, has seized domains used by YAM Store, CoGUI, and Iron Man, key components of a Chinese-language phishing market. These services supplied cybercriminals with accounts, phishing kits, and infrastructure, facilitating over one billion malicious messages targeting consumers and organizations globally since January 2026. The operation also involved US and international law enforcement, as well as cybersecurity firms.","Microsoft and Health-ISAC disrupt Chinese-language phishing market, seizing domains.","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-disrupts-chinese-language-phishing-market-behind-1b-messages\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FAI-phishing.jpeg","2026-10-14T13:00:00+00:00","2026-10-14T14:00:13.040651+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Storm-3119","threat_actor",{"name":24,"type":22},"Storm-2990",{"name":26,"type":27},"YAM Store","product",{"name":29,"type":27},"CoGUI",{"name":31,"type":27},"Iron Man","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,26,29],{"controls":56,"vendors":136},[57,85,110],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,69,77],{"vendor_slug":63,"vendor_name":18,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":36,"name":86,"problem":87,"products":88},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":106,"product_name":107,"url":108,"description":109},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":111,"name":112,"problem":113,"products":114},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":63,"vendor_name":18,"vendor_logo":64,"product_slug":132,"product_name":133,"url":134,"description":135},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[137],{"slug":63,"name":18,"logo_path":64,"roles":138},[139],"reported_by",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"chinese-language-phishing-as-a-service-market-disrupted-after-1b-malicious-messages","Chinese-Language Phishing-as-a-Service Market Disrupted After 1B+ Malicious Messages","The YAM Store, CoGUI, and Iron Man ecosystem represents a mature Phishing-as-a-Service (PhaaS) model, lowering the barrier to entry for cybercriminals by supplying ready-made accounts, phishing kits, and infrastructure at scale. This commoditization of phishing tools means even low-skilled threat actors can launch sophisticated, high-volume campaigns targeting consumers and enterprises globally. The operation's success required coordination between Microsoft, Health-ISAC, federal courts, and international law enforcement — underscoring that no single organization can combat industrialized cybercrime alone. It also highlights that phishing infrastructure, once established, can generate billions of malicious messages before detection and takedown occur, making proactive defense critical.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-177 – Trustworthy Email","NIST CSF ID.RA-2 – Cyber threat intelligence shared with threat intelligence partners","NIST CSF PR.AT-1 – Users are informed and trained","NIST CSF DE.CM-3 – Personnel activity is monitored","MITRE ATT&CK T1566 – Phishing","GDPR Article 32 – Security of Processing (obligation to protect personal data from phishing-enabled breaches)","ITIL – Service Continuity and Security Management Practice",{}]