Microsoft Disrupts 3 Massive Phishing Platforms

How the attack worked

Microsoft says three phishing-as-a-service platforms, referred to as YAM Store, CoGUI, and Iron Man, allowed attackers to operate at global scale. Microsoft estimates these platforms were tied to more than 750 million messages targeting Microsoft customers alone since January. Iron Man reportedly functioned as a phishing-kit-as-a-service operation, offering more than 2,300 pre-built lure pages impersonating trusted services such as postal companies, traffic fine offices, tax agencies, banks, and telecoms. YAM Store allegedly operated as an initial access broker marketplace, selling infrastructure built on compromised or fraudulently obtained cloud environments from providers like Microsoft and Google.

A key technique across these campaigns involved buying expired domains that once belonged to real companies, then rebuilding those sites to look like the legitimate originals. This gave phishing pages an air of authenticity that made them harder for both automated filters and human recipients to flag as suspicious.

Why it succeeded

These platforms succeeded because they lowered the technical barrier to running convincing phishing campaigns. Instead of building lure pages from scratch, less skilled attackers could rent or buy ready-made kits tailored to specific brands, industries, and countries. Combining expired-domain reuse with polished lure pages impersonating trusted institutions made messages feel routine and low-risk to click, which is exactly what toll scam texts and fake delivery emails rely on.

What to watch for

• Unexpected delivery notifications urging immediate action, such as “Delivery attempt failed, reschedule now”
• Toll, traffic fine, or tax messages demanding fast payment to avoid a penalty
• Links that lead to domains not matching the real organization, including ones that may be reused expired domains
• Login prompts asking for Microsoft 365 or other work credentials to complete an unrelated task, like paying a fine or rescheduling a package

The goal in most of these cases is to steal credentials, personal information, banking data, and other login details, which can then be resold or used for further access.

Building resistance

• Treat unexpected delivery, toll, or fine messages as suspicious and avoid clicking embedded links. Go directly to the official site or app instead.
• Check the exact web address before entering any login details, since lookalike and expired-domain sites are a documented tactic in these campaigns.
• Flag and report any page that asks for Microsoft 365 credentials to complete an unrelated action, such as shipping or bill payment.
• Remind finance, executive, and customer support teams specifically, since they are common targets for urgent-sounding lures tied to payments or account access.

These same patterns, urgency, brand impersonation, and credential harvesting through unrelated workflows, appear repeatedly across phishing and smishing campaigns regardless of the specific platform behind them.

What did Microsoft do about these phishing platforms?

Microsoft used a U.S. court order to seize and redirect domains tied to three phishing platforms that it says helped send hundreds of millions of scam messages worldwide.

What is Iron Man in this context?

Iron Man is described as a phishing-kit-as-a-service operation offering more than 2,300 pre-built lure pages impersonating postal companies, traffic fine offices, tax agencies, banks, and telecoms.

What were attackers mainly trying to steal?

The goal was mostly to steal Microsoft 365 and other login credentials, personal data, and banking information.

How did attackers make fake sites look legitimate?

They reportedly bought domains that real companies had let expire and rebuilt them to look like legitimate platforms.