Microsoft and Health-ISAC seize domains behind a billion-message phishing network that hit healthcare targets

MedDevice Cyber Staff · 4 days ago · 3 min read · Via Microsoft On the Issues

Microsoft's Digital Crimes Unit and Health-ISAC obtained an order from the U.S. District Court for the Southern District of Florida and used it on October 14 to seize and redirect domains running three phishing-as-a-service platforms. YAM Store sold fraudulent Microsoft and Google accounts along with other credential-theft tools. CoGUI supplied ready-made impersonation websites and messages, used mainly against Japan and the United States before Iron Man displaced it by mid-2026. Iron Man itself offered more than 2,300 templates impersonating banks, retailers, transportation authorities, police, government agencies, and healthcare providers.

The three platforms have sent more than a billion malicious messages since January 2026, Microsoft said, reaching more than 75,000 organizations across more than 150 countries. More than 750 million of those messages targeted Microsoft's own customers. The operators generated tens of millions of dollars. Since the seizure, Microsoft has disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud.

Japan's National Police Agency opened the trail in late 2025 after flagging campaigns against targets in Japan, and the Japan Cybercrime Control Center, a network of more than 130 member organizations, confirmed the operation's scale there. Health-ISAC, the health sector's global threat-sharing nonprofit, co-led the domain seizures and provided the healthcare-impact analysis. Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs contributed intelligence, and Microsoft shared what it gathered with the U.S. Secret Service and other law enforcement partners.

Healthcare providers sit on Iron Man's impersonation list next to banks and government agencies, which is the part of this case that belongs in a device maker's threat model. Phishing is still the most common way an attacker gets a foothold inside a manufacturer's corporate network, and corporate network access, not a flaw in a shipped device, is how most of 2026's medtech breaches started. A platform this size does not need to compromise a single device. It only needs one employee anywhere in the supply chain to click.

Microsoft has not named specific healthcare victims beyond saying providers were impersonated, and the civil filing, routed through Microsoft's pleadings page, does not identify defendants publicly. Steven Masada, associate general counsel and general manager of Microsoft's Digital Crimes Unit, said the Chinese-language marketplace behind the three platforms has been difficult for non-native-speaking investigators to penetrate. No patch applies here, since the action removes infrastructure rather than fixing a vulnerability. The open question for device makers is whether their own phishing-simulation and email-filtering logs show any of the three service names.

Questions & Answers

What are YAM Store, CoGUI, and Iron Man?

They are three phishing-as-a-service platforms that Microsoft's Digital Crimes Unit and Health-ISAC disrupted on October 14, 2026. YAM Store sold fraudulent Microsoft and Google accounts, CoGUI supplied ready-made impersonation sites aimed mainly at Japan and the United States, and Iron Man offered more than 2,300 templates impersonating banks, retailers, and healthcare providers.

Did the Microsoft and Health-ISAC phishing takedown involve a medical device vulnerability?

No. The October 14, 2026 action targeted phishing infrastructure, not a flaw in any device. Healthcare providers were among the organization types impersonated in Iron Man's templates, and Health-ISAC co-led the domain seizures because healthcare was one of the sectors the three platforms targeted.

How big was the phishing operation that Microsoft and Health-ISAC shut down?

The three platforms sent more than a billion malicious messages since January 2026, reached more than 75,000 organizations in over 150 countries, and generated tens of millions of dollars, according to Microsoft. The company has disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 impersonation domains.

← Back to Threat Intel