Microsoft and Health ISAC seize domains powering massive Chinese phishing network

Microsoft and Health-ISAC have seized and redirected web domains powering three Chinese-language cybercrime components used in global phishing campaigns, SecurityWeek and The Hacker News reported on October 14, 2026. The operation targeted YAM Store, CoGUI, and Iron Man, which supplied criminals with cloud infrastructure, stolen accounts, and phishing kits. According to SecurityWeek, the joint action was backed by a legal order from the United States District Court for the Southern District of Florida. [1][2][3]

Dark Reading and SecurityWeek both report that the sprawling marketplace provided tools that helped fuel more than one billion phishing messages globally. The Hacker News reported that Health-ISAC and Microsoft were supported in the operation by the Japan Cybercrime Control Center, along with private sector firms including Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs. SecurityWeek noted that Health-ISAC joined the civil lawsuit because attackers frequently used the infrastructure to target the healthcare sector. [1][2][3]

The impacted platforms include CoGUI, which is also known as NX or FA, Iron Man, and Haozi, also known as Phoenix, according to The Hacker News. Dark Reading reported that YAM Store functioned as a cybercrime marketplace providing cloud infrastructure alongside automated kits for large-scale operations. [1][3]