Japanese police tip-off helps dismantle three Chinese-speaking phishing platforms

According to Microsoft's statement of 14 October, the investigation began in late 2025 after a warning from Japan's National Police Agency; the Japan Cybercrime Control Center (JC3) confirmed the scale of the impact on Japanese organisations. The domains were seized under an order from the US District Court for the Southern District of Florida. More than 20,000 accounts linked to YAM Store were shut down and more than 100,000 impostor domains were blocked. Since January the platforms had impersonated more than 75,000 organisations in over 150 countries. Messages sent to Microsoft customers alone exceeded 750 million.

The Record reports that the three platforms belong to a single Chinese-speaking cybercrime ecosystem. CoGUI supplied ready-made fake sites and messages and was used heavily in Japan; criminals migrated to Iron Man in mid-2026. Iron Man offered more than 2,300 ready-made pages impersonating postal services, traffic-fine systems, tax authorities, banks and telecoms operators, with Australian, Japanese and Indian templates included in its subscription packages. YAM Store operated as an initial access broker, a marketplace selling compromised corporate accounts, including Microsoft 365 and Google environments. The operators are estimated to have earned tens of millions of dollars; the exact sum could not be verified.