Microsoft and the Health-ISAC secured a U.S. court order to seize and redirect domains tied to YAM Store, CoGUI and Iron Man, three services that sold phishing tools and compromised accounts to cybercriminals. The operation disabled over 20,000 accounts linked to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. Since January, these services enabled scammers to send over 75,000 phishing messages to organizations in more than 150 countries, generating tens of millions of dollars. The investigation began after Japan's National Police Agency alerted Microsoft to scams targeting consumers and businesses late last year. Researchers traced the campaigns to a Chinese-language marketplace where criminal groups purchased ready-made phishing infrastructure. YAM Store provided fraudulently obtained Microsoft and Google accounts, cloud resources and hosting. Some operators revived expired nonprofit and educational domain names to create seemingly legitimate sites for reselling Microsoft 365 accounts. CoGUI and Iron Man supplied pre-built phishing pages and messages that mimicked banks, retailers, transport authorities and government agencies. Microsoft and security firm Resecurity identified over 2,300 Iron Man templates, allowing attackers to customize scams for specific brands and regions. Crypto payments were accepted through Tether's USDT and Ethereum, with YAM Store supporting USDT on the Tron network alongside Alipay and WeChat Pay. Cloudflare noted buyers could also pay with USDC. Blockchain analytics firm TRM Labs assisted investigators in locating and freezing assets tied to the group, though the total value frozen was not disclosed. Cloudflare suspended accounts, disabled Workers projects supporting phishing pages and banned hundreds of related domains and projects. It displayed warning pages for malicious links where domain seizure was not possible. Microsoft found that Iron Man's subscription model relied on a vendor-controlled licensing server, and disabling that infrastructure could disrupt customers' ability to use purchased kits, even if copies remained in circulation. The enforcement effort involved Japan's police, the Cybercrime Control Center, Oracle, Proofpoint, Resecurity and U.S. law enforcement partners. Microsoft described the targeted suppliers as part of a broader criminal network, with related infrastructure still being removed. The next challenge involves limiting how quickly suppliers can replace seized domains and compromised accounts. Some domain registrars operate in jurisdictions that complicate legal seizures, so Cloudflare blocks access through security warnings while those domains remain online.