Last updated: October 15, 2026
The quick answer
Microsoft and the health-sector security group Health-ISAC used a US court order to seize domains behind three phishing services (YAM Store, CoGUI and Iron Man) that powered more than a billion scam emails and texts this year, including many fake toll, package and tax alerts. The takedown helps, but similar messages will keep coming, so the safest habit is still to never act on a link in an unexpected message.
What happened
On October 14, Microsoft announced that it had disrupted three Chinese-language cybercrime services that sold ready-made phishing tools to scammers. A federal judge in the Southern District of Florida granted Microsoft and Health-ISAC permission on October 7 to take control of the domains the services relied on, cutting them off, at least for now.
Microsoft says the three services together enabled more than one billion malicious messages since January 2026, aimed at more than 75,000 organizations in over 150 countries. More than 750 million of those messages targeted Microsoft customers. The investigation began after a tip from Japan’s National Police Agency, and partners included Resecurity, Proofpoint, TRM Labs, Cloudflare and Oracle.
| Service | What it sold to scammers |
|---|---|
| YAM Store | Fraudulent or compromised Microsoft and Google accounts and other tools used to launch attacks |
| CoGUI | Ready-made fake websites and messages impersonating governments, banks and tech companies |
| Iron Man | A subscription phishing kit with more than 2,300 templates impersonating healthcare providers, retailers, police and other organizations |
Microsoft also disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation. The company acknowledged that this will only dent the wider phishing economy, since other kits remain in circulation.
What this means for you
These kits are the factories behind many of the scam texts and emails people see every week. Reporting on the takedown links them to messages claiming that a package could not be delivered, that a road toll or traffic fine is unpaid, that a bank account has a problem, or that a tax bill is overdue. The goal is to get you to a convincing fake page where you type in a password, card number or personal details.
Taking down the infrastructure may reduce some of this traffic for a while. It will not stop it, because criminals move to new tools quickly. Reports note that scammers in Japan had already shifted from CoGUI to Iron Man by mid-2026. Treat this news as a reminder, not an all-clear.
How to spot and handle toll, package and tax scam messages
- Don’t tap the link. If a message says you owe money or missed a delivery, open the official app or type the company’s web address yourself to check.
- Look for pressure. Short deadlines, threats of fines, license suspension or “final notice” wording are classic signs of phishing.
- Check the sender and the link. Messages from random phone numbers or email addresses, and links with misspelled or unusual domains, are red flags. A real-looking page is not proof: these kits copy real sites closely.
- Report it, then delete it. In the US you can forward scam texts to 7726 (SPAM) and report fraud at ReportFraud.ftc.gov. Most phone messaging apps also have a “Report junk” option.
- Turn on stronger sign-in. Use two-step verification or passkeys on email, banking and shopping accounts so a stolen password alone is not enough.
If you already entered your details
- Call your bank or card issuer using the number on the back of your card and ask them to block the card and watch for fraud.
- Change the password on the affected account, and on any other account that used the same password.
- Sign out of other sessions in your account’s security settings and review recent activity.
- Watch for follow-up calls or texts pretending to be your bank’s fraud team; scammers often strike twice.
For more on cleaning up after your data leaks, see our guides on Japan’s recent cyberattack wave and the ASOS data breach. Shopping-season scams follow the same patterns, as we covered in our Prime Big Deal Days scam guide.
Who is affected, and who isn’t
Most exposed: anyone who gets texts or emails about deliveries, tolls, taxes or bank issues, which is nearly everyone with a phone. The campaigns were especially heavy in the United States and Japan, and the kits included templates for many other countries. Healthcare and financial organizations, and their staff, were also major targets.
Less affected: people who already verify alerts through official apps, and accounts protected by passkeys or two-step verification. There is nothing to install or update because of this news; Microsoft’s action happened on the server side.
FAQ
Does this mean scam texts will stop?
No. Microsoft itself said the action only makes a dent. Other phishing kits are still active, and criminals tend to switch tools quickly after a takedown.
I got a text about an unpaid toll. Is it from these kits?
It could be, but you cannot tell from the message alone. Treat any unexpected toll or delivery text as suspicious, and check your balance only through the official toll or carrier website or app.
Do I need to do anything with my Microsoft account?
Not because of the takedown itself. It is still a good moment to confirm two-step verification or a passkey is turned on, and to review recent sign-in activity.
Sources
- Microsoft On the Issues: Disrupting the service economy behind transnational cybercrime operations
- Cybersecurity Dive: Microsoft, Health-ISAC and partners take down popular phishing kit services
- The Record: Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
- CyberScoop: Microsoft disrupts Chinese-language phishing kit ecosystem
Leave a Reply