Scam-Kit Takedown Broke Key Links, Health-ISAC Security Chief Says

Errol Weiss, Chief Security Officer at Health-ISAC, told Hooray News in an email interview on Nov. 5 that seizing the web domains behind three Chinese-language scam services, YAM Store, CoGUI and Iron Man, measurably disrupted active phishing deliveries tied to those kits. Microsoft and Health-ISAC announced the court-backed takedown on Oct. 14.⁸¹

Phishing is the scam email or text that tricks people into handing over passwords or payment details. These three services sold scammers the tools to do it, including fraudulent accounts, ready-made fake websites and message templates.¹

“The scam message is often the only part victims see. The businesses behind it are what make it possible.” (Steven Masada, Microsoft’s Digital Crimes Unit, in Microsoft’s announcement)¹

What the YAM Store, CoGUI and Iron Man takedown did

Under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that powered the three services.¹² It is a civil action. Proofpoint reports that Microsoft and Health-ISAC also filed a lawsuit against the YAM Store threat actors and individuals linked to the phishing operations.⁴

Our earlier story covered the shopping angle. YAM Store ran like an online shop selling fraudulent Microsoft and Google accounts and other ready-made scam tools, and Microsoft’s own test purchases helped confirm how it worked.⁷¹ It took Alipay, WeChat Pay and cryptocurrency, because even crooks like an easy checkout.⁶

CoGUI supplied fake websites and messages posing as companies, banks and government agencies. Iron Man, which was increasingly replacing it by mid-2026, offered more than 2,300 impersonation templates covering more than 150 countries, according to Microsoft. Microsoft stresses that appearing in a template does not mean an organization was hacked.¹

Related: Scammers Ran an Online Store. One of Its Customers Was Microsoft

Microsoft estimates the services enabled more than 1 billion malicious messages aimed at more than 75,000 organizations since January 2026. That is Microsoft’s estimate of messages the services made possible, not a count of messages delivered.¹ The investigation began in late 2025 with a tip from Japan’s National Police Agency about scam campaigns targeting people in Japan.¹

What Health-ISAC has seen since the seizure

Health-ISAC is a global nonprofit that helps health-sector organizations share information about cyber threats. It joined the case because criminals often used this infrastructure against hospitals and healthcare organizations.¹³

“The seizure immediately broke key infrastructure links, resulting in a measurable disruption in active phishing deliveries associated with these specific cybercriminal kits.”⁸

Weiss confirmed that Microsoft’s figures still stand. He said Health-ISAC relies on Microsoft and the other partners for that kind of data and does not have a breakdown of how many targets were healthcare organizations.⁸

He was also clear about the limits of a takedown.

“However, legal disruptions and domain takedowns are not a silver bullet. Cybercrime syndicates operate like businesses: when one service gets disrupted, the operators will often try to move to other servers or alternate phishing frameworks.”⁸

That is why Health-ISAC members keep sharing warning signs and data in real time. “That collective visibility allows us to track where threat actors attempt to regroup and alert the entire sector before new campaigns gain traction,” Weiss said.⁸

Weiss’s advice for hospitals and clinics

“For healthcare organizations, the priorities are straightforward: strengthen email and web protections, use phishing-resistant multifactor authentication, and focus on resilience,” Weiss told Hooray News.⁸ Multifactor authentication adds a second check at login. The phishing-resistant kind is built so a fake website cannot simply capture that check and reuse it.

He also recommended robust identity monitoring, limiting access to sensitive clinical applications and regularly rehearsing how to keep running during an attack, “so care delivery is never interrupted.”⁸

What happens next

Microsoft says it has disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. It calls the three services “only part of that larger criminal network,” while adding that disrupting them makes it harder for criminals to get the tools they rely on.¹

Health-ISAC says it will keep working with partners. “Health-ISAC will continue partnering with industry leaders and international authorities to pursue technical disruptions that raise the cost of doing business for cybercriminals,” Weiss said.⁸