PUBLISHED: 15 OCTOBER 2026
Microsoft, Health-ISAC and partners report disrupting online infrastructure used by the YAM Store, CoGUI and Iron Man phishing operations under a US court order. Microsoft says the action disabled more than 20,000 accounts and disrupted over one billion malicious messages affecting approximately 75,000 organisations in more than 150 countries.
ASSESSMENT: The action raises the cost of credential theft and account resale. The use of Chinese-language marketplaces does not, by itself, establish state direction or attribution to China. The disruption’s long-term effect will depend on whether operators rebuild infrastructure.
Source: Microsoft Security Blog, 15 October 2026; Health-ISAC.