Acting under an order granted by the US District Court for the Southern District of Florida, investigators dismantled an illicit ecosystem that has fueled over one billion malicious messages across more than 150 countries since January. The sweeping attacks targeted consumers, banks, healthcare networks, and over 75,000 organizations globally, generating tens of millions of dollars for their operators while directing more than 750 million fraudulent messages at Microsoft customers alone. In a major coordinated offensive against transnational cybercrime, Microsoft and the Health Information Sharing and Analysis Center have seized and redirected the online infrastructure powering three Chinese-language cybercrime stores known as YAM Store, CoGUI and Iron Man.
The syndicate frequently bought expired domains previously owned by schools and charities, reviving the sites to generate Microsoft 365 tenant accounts before accepting payment via Alipay, WeChat Pay, and Tether cryptocurrency.
The illicit operations functioned as commercial, turnkey fraud clearinghouses developed by Chinese-speaking threat actors, according to Microsoft Threat Intelligence. YAM Store mirrored an everyday e-commerce storefront, allowing prospective scammers to compare prices and buy ready-made exploitation kits alongside illicit Microsoft and Google accounts.