Skip to content
Scammers.com
PhishingReviewed

Cloudflare and Microsoft disrupt Yam Store illicit access shop

Cloudflare and Microsoft disrupted Yam Store, a Chinese-language marketplace selling stolen Microsoft business accounts and phishing kits (CoGui and Iron Man) via Telegram.

First reported
Reports
1

Source: cloudflare.com · published

Screenshot of a Yam Store product page selling an Office 365 licence, from Cloudflare's report
Image: Cloudflare

What happened

Cloudflare's Cloudforce One team said in an October 14, 2026 threat brief that it worked with Microsoft and other industry and law-enforcement partners on "Roasted Roots", a campaign to disrupt Yam Store and the phishing toolkits CoGui and Iron Man.

Yam Store, localised in simplified Chinese, sold stolen accounts and tools for phishing retail, government and cloud services. Victims of the account theft included non-profits, financial institutions and healthcare organisations around the world.

How the scam works

Yam Store is a simple storefront where criminals buy Microsoft business accounts with different support levels. Accounts are advertised on a Telegram channel (568 subscribers) with stock counts and links to product pages, and buyers pay in USDT or USDC.

The accounts were stolen by phishing kits like CoGui and Iron Man, which abused Cloudflare Workers and CDN services to host phishing pages.

Disruption included a Microsoft civil action in a U.S. court to have registrars suspend malicious domains and hand them to Microsoft's Digital Crimes Unit; Cloudflare banning hundreds of domains and Workers projects; and, for domains that couldn't be seized, warning interstitials so victims who click a phishing link see a security alert.

Source

Cloudflare threat brief, "Yam Store closing early" (October 14, 2026).

Red flags

  • Login pages for Microsoft 365 or other work accounts reached through email links.
  • Unexpected sign-in prompts or alerts about logins from unfamiliar places.
  • Messages pushing urgent action on a work account.

If you were targeted

  1. 1Use phishing-resistant sign-in (passkeys or hardware security keys) where possible.
  2. 2If you entered work credentials on a suspicious page, tell your IT team immediately so they can reset the password and revoke sessions.
  3. 3Organisations: require managed devices, flag impossible travel, shorten session lifetimes and enforce strict DMARC, as Cloudflare recommends.
ReportFraud.ftc.gov FBI IC3 More resources