Microsoft and Health-ISAC reportedly used a Southern District of Florida civil action to seize and redirect domains tied to YAM Store, CoGUI, and Iron Man, three services linked in supplied reports to stolen accounts and phishing tools. In those reports, crypto primarily served as a payment rail for the services, including a specific claim that YAM Store accepted USDT on Tron.

What Microsoft and the court action reportedly disrupted

The reported action targeted the infrastructure behind YAM Store, CoGUI, and Iron Man, rather than a single phishing webpage. Supplied snippets say Microsoft and Health-ISAC used a Southern District of Florida civil action to seize and redirect related domains, while disabling YAM Store-linked accounts and blocking impersonation and fraud domains.

A Microsoft notice snippet identifies the matter as Civil Action No. 1:26-cv-26998-JEM, with Microsoft Corporation and Health-ISAC as plaintiffs and Yang Jian d/b/a Yam Store, Inc. plus Does 1-10 as defendants. That legal framing is significant because it describes a civil infrastructure-disruption case, not a reported criminal conviction or a final judgment covering every operator allegedly connected to the ecosystem.

Supplied reporting characterizes the three services as part of an upstream scam supply chain. Under that account, YAM Store sold illicitly obtained Microsoft and Google accounts, while CoGUI and Iron Man offered phishing pages, kits, or impersonation templates that could be used to impersonate banks, government agencies, and other trusted entities.

How USDT, USDC, and ETH fit into the scheme

Based on the available evidence, these assets were not the phishing mechanism itself. The supplied reporting describes USDT, USDC, and ETH as payment options for purchasing stolen accounts, phishing kits, and related services within the ecosystem.

The clearest detail in the supplied material is that YAM Store accepted USDT on Tron. The same flash also says USDC and ETH were accepted, but it does not provide reviewed payment pages, wallet evidence, or a service-by-service mapping to support those broader claims.

That distinction matters for readers drawn to the crypto angle. The reported abuse is better understood as the monetization of criminal services: attackers allegedly used crypto to buy access to scam infrastructure, rather than using token transfers as the direct means by which organizations were phished.

What is known about the takedown scale and remaining details

Supplied reports attribute substantial figures to Microsoft, including more than 20,000 linked accounts disabled and more than 100,000 impersonation and fraud domains blocked. They also describe the network as being associated with more than 1 billion malicious messages targeting over 75,000 organizations in more than 150 countries.

Those figures help illustrate the scale, but they do not resolve the most detailed enforcement questions. The available material does not include the full court order, the precise domain list, or the specific mechanics behind any reported asset freeze.

The supplied flash says TRM Labs helped identify and freeze digital assets linked to the group, but no amount was disclosed. It also does not establish which entity carried out any freeze, on which chain it occurred, or whether a custodian, issuer, or other intermediary was involved. Timing is another unresolved issue: the supplied flash gives a May 2025 event date, while matching Microsoft and partner snippets point to October 2026 for the civil action and public notice.