A joint legal action by Microsoft and the healthcare sector’s threat-sharing center has severed the domain names behind three Chinese-language phishing marketplaces that sold ready-made campaigns impersonating hospitals, insurers and government agencies.
A federal judge in the Southern District of Florida granted the request on October 7, giving Microsoft control of the sites operated by YAM Store, CoGUI and Iron Man. The three services enabled more than one billion malicious messages targeting over 75,000 organizations worldwide since January 2026, Microsoft said, with attackers reaching banks, healthcare providers and consumers across more than 150 countries.
Health-ISAC, the information sharing and analysis center for the medical sector, fed Microsoft intelligence on how the campaigns were hitting care organizations. Iron Man in particular sold thousands of templates impersonating healthcare firms, retailers and police departments, giving low-skill criminals a polished hospital-branded lure without any coding.
Microsoft said it has already disabled more than 20,000 fraudulent accounts and continues pulling down infrastructure and blocking phishing domains. Partners included Japan’s National Police Agency, Proofpoint, Resecurity, TRM Labs, Cloudflare and Oracle, with AI tools used to link infrastructure that looked unrelated.
For hospital security teams the takedown removes one supply line, not the threat. Microsoft cautioned that other marketplaces remain active. Because the kits specialized in credential harvesting, clinical staff-facing mailboxes and single sign-on pages remain the highest-value targets. Health systems should reinforce phishing-resistant multi-factor authentication on email and identity portals, and refresh staff training on vendor and payroll lures that impersonate the organization.
