[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyy9j_cFnE0_rZAhy6DAr1LOalFQ-r4UvSxyiNThso_c":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f6edd4b1-1b52-4650-a43c-0ca0a5fcdbc3","Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages","microsoft-seizes-yam-store-and-phishing-kit-domains-linked-to-1b-malicious-messa-e0d594","Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI and Iron Man, services that enabled over 1…","Microsoft and Health-ISAC have taken down domains associated with the YAM Store, CoGUI, and Iron Man cybercrime services. These Chinese-language services facilitated over one billion malicious messages since January 2026, targeting organizations and consumers globally with phishing kits, fraudulent accounts, and impersonation templates. The operation, involving multiple international law enforcement agencies and cybersecurity firms, disrupted a significant infrastructure used for credential theft and fraud.","Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI, and Iron Man services.","https:\u002F\u002Fhackread.com\u002Fmicrosoft-seizes-yam-store-phishing-kit-domains\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fmicrosoft-disrupts-cybercrime-marketplace-behind-1-billion-malicious-messages-1.png","2026-10-15T10:34:53+00:00","2026-10-15T12:00:16.577631+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Health-ISAC",{"name":26,"type":27},"YAM Store","threat_actor",{"name":29,"type":27},"CoGUI",{"name":31,"type":27},"Iron Man","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[],[21,24,18],{"controls":58,"vendors":139},[59,87,113],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":81,"vendor_name":21,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":88,"name":89,"problem":90,"products":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[92,100,105],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":81,"vendor_name":21,"vendor_logo":82,"product_slug":101,"product_name":102,"url":103,"description":104},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,126,131],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":81,"vendor_name":21,"vendor_logo":82,"product_slug":127,"product_name":128,"url":129,"description":130},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[140],{"slug":81,"name":21,"logo_path":82,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":160},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","The YAM Store, CoGUI, and Iron Man cybercrime services operated as turnkey phishing-as-a-service platforms, lowering the barrier for criminals to launch large-scale credential theft campaigns by providing ready-made impersonation templates, fraudulent accounts, and phishing kits. Over one billion malicious messages were sent in just months, demonstrating how commoditized cybercrime infrastructure can amplify attacks to a global scale with minimal technical skill required. The operation highlights that end users and organizations remain highly vulnerable to phishing when security awareness training and email filtering controls are inadequate. It also underscores the critical role of public-private partnerships and coordinated legal action in dismantling cybercriminal ecosystems before further damage occurs.",[148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-177 – Trustworthy Email (DMARC\u002FDKIM\u002FSPF)","NIST AC-2 – Account Management","NIST IA-5 – Authenticator Management (MFA)","NIST AT-2 – Awareness Training","GDPR Article 32 – Security of Processing (for EU organizations impacted by credential theft)","ITIL 4 – Service Value Chain: Detect and Respond","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1598 – Phishing for Information",{}]