微软和Health-ISAC已查获并重定向了三个中文网络犯罪服务YAM Store、CoGUI和Iron Man背后的域名，微软周三表示。自2026年1月起，这三项服务已实施超过10亿条针对全球超过7.5万家组织的恶意消息。
Microsoft and Health-ISAC have seized and redirected domains behind three Chinese-language cybercrime services, YAM Store, CoGUI and Iron Man, Microsoft said on Wednesday. Since January 2026, the three services enabled more than 1bn malicious messages targeting over 75,000 organisations worldwide.
微软表示，其中超过7.5亿条消息针对微软客户。这些消息针对超过150个国家的消费者、医疗机构、银行和其他企业。它们为服务运营商带来了数千万美元的收入。
More than 750 million of those messages targeted Microsoft customers, the company said. They targeted consumers, healthcare groups, banks and other businesses in more than 150 countries. They generated tens of millions of dollars for the services’ operators.
“看似简单的诈骗消息往往是更大规模跨国网络犯罪行动的可见端点。”微软数字犯罪部门总经理Steven Masada表示。## 一条始于日本的线索 调查始于2025年底，当时日本国家警察局向微软通报了针对日本民众的诈骗活动。随后，调查扩大，涉及日本网络犯罪控制中心、Resecurity、Cloudflare、Oracle、Proofpoint和TRM Labs。微软还与美国特勤局及国际执法伙伴共享了情报。
“What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”Steven Masada, general manager of Microsoft’s Digital Crimes Unit ## A trail that started in Japan The investigation began in late 2025, after Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. It expanded to involve the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft also shared intelligence with the US Secret Service and international law enforcement partners.
微软表示，YAM Store的运营方式类似于一个在线商店。客户可以浏览和比较价格。他们可以购买欺诈性的微软和谷歌账户以及现成的诈骗工具。在某些情况下，其运营商获取了非营利组织和学校所放弃的域名。他们重建了这些网站，以获取可供出售的Microsoft 365账户。根据微软威胁情报，该店接受通过支付宝、微信支付和USDT进行的付款。
YAM Store operated much like an online shop, Microsoft said. Customers could browse and compare prices. They could buy fraudulent Microsoft and Google accounts and ready-made scam tools. In some cases, its operators acquired domains that nonprofits and schools had let expire. They rebuilt the websites to get Microsoft 365 accounts to sell. The store accepted payment through Alipay, WeChat Pay and USDT, according to Microsoft Threat Intelligence.
CoGUI 为犯罪分子提供了即用型网站和冒充可信组织的消息。到 2026 年中期，一种名为 Iron Man 的新产品正日益取代它。调查人员发现超过 2,300 个 Iron Man 模板，冒充银行、零售商、医疗保健提供者、警察部门和政府机构。其在美国的诱饵大多涉及交通或政府事务，例如交通和停车费，微软表示。
CoGUI supplied criminals with ready-made websites and messages impersonating trusted organisations. By mid-2026, a newer offering called Iron Man was increasingly replacing it. Investigators identified more than 2,300 Iron Man templates impersonating banks, retailers, healthcare providers, police departments and government agencies. Most of its US lures concerned transport or government matters, such as traffic and parking fees, Microsoft said.
微软高度确信，中文使用的威胁行为者开发了这些工具包。犯罪分子利用它们窃取密码和支付数据。其目的是用被盗数据购买高端商品，或在金融平台上进行交易。
Chinese-speaking threat actors developed the kits, Microsoft assesses with high confidence. Criminals used them to steal passwords and payment data. The aim was to buy high-end goods, or make transactions on financial platforms, with the stolen data.
微软和 Health-ISAC 在佛罗里达州南区美国地方法院的命令下采取行动。微软已禁用超过 20,000 个与 YAM Store 相关的账户。它还在阻止超过 100,000 个用于冒充和欺诈的域名。
Microsoft and Health-ISAC acted under an order from the US District Court for the Southern District of Florida. Microsoft has disabled more than 20,000 accounts connected to YAM Store. It is also blocking more than 100,000 domains used for impersonation and fraud.
“YAM Store、CoGUI 和 Iron Man 只是更大犯罪网络的一部分，但破坏它们会使犯罪分子更难以获取他们依赖的账户、工具和基础设施。” 微软的 Steven Masada 如是说。
“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.”Steven Masada, Microsoft