The seller behind YAM Store, a storefront for phishing infrastructure, waited for real organizations' domains to expire, re-registered them, rebuilt their websites, and used them to open Microsoft 365 tenants for resale, according to a federal complaint that Health-ISAC filed as co-plaintiff.

Buyers typically received Global Administrator access, so they could send phishing from a tenant built on a domain that once belonged to a legitimate organization.

The complaint says one Health-ISAC member "suffered an intrusion into their protected computer systems after a member's user unknowingly clicked on a malicious link in a CoGUI phishing email."

What Health-ISAC and Microsoft took down

In October 2026, Health-ISAC and Microsoft moved against three services in a Chinese-language cybercrime marketplace: YAM Store, CoGUI and Iron Man. The case is Microsoft Corporation and Health-ISAC, Inc. v. Yang Jian d/b/a Yam Store, Inc., No. 1:26-cv-26998, in the U.S. District Court for the Southern District of Florida.

Health-ISAC's Oct. 15 threat bulletin links the three services to more than one billion malicious messages aimed at over 75,000 organizations across 150 countries, health sector organizations among them.

According to that bulletin, the disruption included domain seizures, more than 20,000 disabled accounts, and more than 100,000 blocked impersonation domains.

Phishing as something you buy

The complaint describes two tiers of defendants. Infrastructure providers sell the software, hosting, payment accounts and distribution, while phishing defendants buy those pieces and run the campaigns.

Expired domains were one of three ways YAM Store stocked its shelves. The complaint says the seller also registered fake educational tenants by posing as students or teachers, and used stolen credentials to take over real customer accounts and resell them.

Iron Man's kit came with templates built to impersonate government agencies, healthcare organizations, banks, transportation companies and online retailers.

The person sending the lure no longer has to write a kit, stand up hosting, or build a convincing login page. Those come prepackaged, and the complaint shows how far one buyer can take them: at its peak, a single CoGUI operator's setup sent more than 65,000 phishing emails a day.

Healthcare was a named target

The complaint says the defendants "used Yam Store infrastructure to attack multiple Health-ISAC members." A separate defendant is accused of using a CoGUI instance "to victimize multiple American health care businesses who are members of Health-ISAC."

The American Hospital Association flagged the action for hospitals on Oct. 16, and Becker's reported that the services had been running since January 2026.

Where sender authentication stops helping

SPF, DKIM and DMARC tell a receiving server whether a message came from the domain it claims. When the attacker controls that domain, the check comes back clean.

A previously legitimate domain under new ownership can also carry whatever reputation it built before it lapsed. Filtering that leans on sender domain alone has little to flag.

Your own domains still need DMARC enforcement, because Iron Man's templates were built to impersonate healthcare organizations like yours. In the 2026 Healthcare Email Security Report, Paubox found that 74% of healthcare organizations breached through email in 2025 lacked effective DMARC enforcement.

What Health-ISAC told members to do

The bulletin's guidance is direct: "strengthen phishing-resistant multifactor authentication, monitor suspicious authentication activity, and implement domain impersonation protections." It also tells members to "review email security controls, investigate indicators of credential compromise, and stay aware of evolving phishing-as-a-service infrastructure."

For your team, that translates into a short list:

  • Move high-risk roles, including admins, billing and anyone who approves payments, to phishing-resistant MFA
  • Alert on sign-ins from new locations and on new inbox forwarding rules, since credential harvesting is the goal of these kits
  • Enforce DMARC at quarantine or reject on every domain you own, including parked ones
  • Keep renewing domains you have retired, because the complaint shows lapsed domains getting re-registered and reused
  • Audit any allowlist or gateway rule that trusts mail based on sender domain alone
  • Don't treat a sender as trusted because it comes from an .edu or similar domain type, since YAM Store built fake educational tenants

Detection that reads the message itself closes the gap that domain reputation leaves open. Paubox inbound email security analyzes tone, sender behavior and message intent to flag mail that deviates from normal, and ExecProtect+ blocks lookalike domains and compromised accounts that impersonate colleagues.

Inbound protection is one part of HIPAA compliant email. Encryption, a signed BAA, and audit logs cover the rest.

Related: Microsoft dismantles phishing service that used AI to read inboxes