On 14 October 2026, Microsoft announced it had used a US court order to seize and redirect domains behind three Chinese-language phishing services: YAM Store, CoGUI and Iron Man. Its Digital Crimes Unit worked with Japan's National Police Agency and Health-ISAC. Microsoft's own account says the three services sent more than 1 billion malicious messages since January, more than 750 million of them aimed at Microsoft customers. They targeted over 75,000 organisations across more than 150 countries.
The operation is worth studying for its method more than its size. It shows that the most effective response to industrialised cybercrime may be targeted, evidence-led, public-private action, not sweeping new mandates on platforms.
What was actually disrupted
The three services are not one gang. They are parts of a supply chain. According to Microsoft's announcement, written by Digital Crimes Unit head Steven Masada, YAM Store sold access to fraudulently obtained or compromised accounts. Microsoft disabled more than 20,000 accounts tied to it. Iron Man sold more than 2,300 pre-built impersonation templates. The Record reports that these cover postal firms, tax agencies, banks and telecoms, with versions tailored to Australia, Japan, India and dozens of other countries. CoGUI was heavily used against people in Japan, and criminals began shifting to Iron Man by mid-2026.
Microsoft says it is also blocking more than 100,000 impersonation and fraud domains. The operators earned "tens of millions of dollars".
A note on numbers: early reports repeated the 750 million figure as the total. Microsoft's own post puts the total at more than 1 billion, with 750 million aimed at its customers. This article uses Microsoft's figures, which are the company's own and have not been independently audited.
The order came from the US District Court for the Southern District of Florida, according to Microsoft. Japan's police flagged the original campaigns. Microsoft also credits Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs with research and investigative support. CyberScoop reports that the kits also abused device-code authentication to obtain access tokens, which shows how criminal tooling evolves around legitimate login flows.
The strongest case for more government mandates
The best argument for heavier regulation is this. A civil seizure is a private action. It depends on one company's willingness to spend on litigation and investigation, and it protects the customers of that company first. Most victims of phishing never see a Microsoft lawyer. Microsoft itself says the takedown covers only part of a larger network. Masada's phrase is "Delete and block one, and another takes its place." If criminals can rebuild in weeks, critics ask, why not require platforms and registrars to meet stricter duties?
That concern is fair. Takedowns are not a deterrent on their own, and no one should read this operation as the end of these services.
Why the targeted model is still the better bet
The response to that argument is about where the leverage sits. Phishing-as-a-service works as a market. The seller of templates, the broker of stolen accounts and the sender of messages are different actors. Removing the account broker raises costs for every downstream buyer at once. Microsoft's own framing is that the businesses behind the message make the scam possible. That is a supply-side strategy, and it is more efficient than trying to inspect every message.
Broad mandates tend to push the other way. Rules that compel monitoring of private communications or traffic would capture huge volumes of lawful speech and commerce. They would do so to catch a small share of criminals who adapt quickly. A court-supervised seizure is different. It requires a named target, evidence presented to a judge, and a defined remedy. Those are the proportionate-regulation features this publication favours.
There are risks to watch. Civil seizure orders are often sought ex parte, meaning the defendants are not heard first. Courts and the public should expect clear documentation of what was seized and why, and a path to challenge mistakes. Seized domains must not sweep in legitimate sites. These are procedural safeguards, not reasons to abandon the tool.
The treaty gap
The international legal layer is moving slower than the criminals. The UN Convention against Cybercrime opened for signature in Hanoi on 25 and 26 October 2025, when seventy-one states and the European Union signed. Under Article 65 it enters into force on the ninetieth day after the fortieth instrument of ratification is deposited. It remains open for signature at UN Headquarters until 31 December 2026. Until it is in force and widely implemented, cooperation depends on existing channels and on ad hoc partnerships like the one between Microsoft, Japan's police and Health-ISAC.
It is the Japanese police referral, not a treaty, that started this case. The pattern is instructive: a national police agency that could see local victims, a company that could see the infrastructure, and a US court that could order the domains redirected. Getting more of that cooperation, with safeguards for speech and privacy built in, matters more than adding new obligations on intermediaries.
What policymakers should take from it
First, support the supply-chain approach. Funding for police units that can refer cases, and clear legal routes for private firms to share evidence, will do more than new content-scanning duties.
Second, insist on transparency. Companies that use civil seizure powers should publish what they seized, how many accounts they disabled and how they handled errors, so that claims like the 20,000-account figure can be checked.
Third, measure outcomes. A takedown that is followed by rapid rebuilding has limited value. Regulators and companies should track whether message volumes and victim losses actually fall in the months after an action, not just count seized domains.
The Microsoft operation is neither a solution nor a gimmick. It is a reminder that precise, accountable enforcement against the commercial infrastructure of crime is available now, and it avoids the collateral costs of broad mandates on the open internet.