Cloudflare participates in global operation to disrupt the yam.ink illicit access shop

Table of contents

Overview

Executive summary

Campaign analysis & threat breakdown

Disruption

Recommendations

Indicators of compromise

Overview

Cloudflare’s Cloudforce One threat research team worked with Microsoft and other industry and law enforcement partners on “Roasted Roots”, a campaign to disrupt the Yam Store illicit marketplace and associated phishing toolkits (CoGui and Iron Man) that facilitated the theft and sale of stolen accounts belonging to non-profits, financial institutions, healthcare organizations, and other victims around the world.

Executive summary

• Cloudflare, in partnership with Microsoft, has taken action against Yam Store, an illicit market localized in simplified Chinese that facilitated the sale of stolen accounts and tools to phish a wide variety of retail, government, and cloud services.

• Yam Store sold accounts that were stolen by prolific phishing kits like CoGui and IronMan which abused Cloudflare’s Workers and CDN services.

• Cloudforce One’s PREDICT researchers teamed up with Cloudflare’s Trust and Safety team to identify every illicit account and their activities.

• This report provides technical details of the actor's TTPs, our disruption strategy, and how others can protect themselves from similar threats.

What is Yam Store?

Yam store is a simple storefront where criminals can purchase a variety of Microsoft business accounts with different support levels and entitlements. The accounts are advertised on a Telegram channel with their available quantity and a link directly to a product page on the Yam storefront website. Criminals purchasing the accounts can pay using USDT or USDC.

The Yam storefront sells illicit digital items like accounts and kits.

Yam Store’s news channel on Telegram shows available accounts. The channel has 568 subscribers.

Following the Telegram channel’s links leads directly to the product page with payment details and information about the stolen accounts.

Disruption

In September 2026, Microsoft and Cloudflare began studying the infrastructure abused by Yam store’s criminal operators. Cloudflare identified numerous domains abusing the CDN as well as Workers scripts used for phishing and scam pages. In mid-October, 2026, Cloudflare placed an interstitial warning page over the Yam store pages, disabled Workers projects, and suspended user accounts.

The operation proceeded through several concurrent but coordinated layers of enforcement:

• Microsoft’s civil action: Microsoft filed a civil action in a U.S. court to legally compel international domain registrars to suspend malicious domains and transfer control to Microsoft’s Digital Crimes Unit. These seized domains will be redirected to a web page displaying a message about the disruption and all of the participating organizations’ logos.

• Mass infrastructure purge: Cloudflare separately executed a comprehensive sweep to clear out all zones associated with the threat, resulting in the banning of hundreds of domains and Workers projects.

• Killing Worker scripts and suspending accounts: Cloudflare developed reliable detection methods for the Workers scripts that have been configured to prevent deployment.

Because the registrars for some of these scam domains are located in non-cooperative jurisdictions, technical intervention remained a critical failsafe. For any infrastructure that could not be legally seized, Cloudflare deployed interstitial warning pages. This ensures that any victim attempting to access a phishing link is blocked by a high-visibility security alert, effectively neutralizing the phishing kit even if the underlying domain remains technically active on the internet.

Mitigation and detection

Effective defense against PhaaS platforms requires email security solutions that rely on proactive identification of delivery infrastructure and advanced behavioral detection models. Cloudflare Email Security maintains this defensive posture through the use of Email Detection Fingerprints (EDF) alongside continuous refinement of specialized detection logic designed to adapt to the actor's shifting tactics.

Cloudflare’s Email Security detections evaluate domain reputation, alongside capabilities to identify suspicious sentiment and branding within the messages. We combine these high-confidence detections in our production environment along with proactive threat hunting techniques to identify emerging email-based threats. Additionally, these detections leverage our machine learning models, which analyze email content, sentiment and metadata to detect and flag malicious messages.

Recommendations

Cloudflare recommends the following steps to mitigate threats from Phishing-as-a-Service operations:

Upgrade to phishing-resistant MFA

• Adopt FIDO2/WebAuthn: Use hardware keys (YubiKeys) or Passkeys. They use a cryptographic handshake that fails if the URL is even slightly off.

• Deploy Certificate-Based Auth (CBA): Restrict access to devices with unique, pre-installed digital certificates to ensure only trusted hardware can connect.

Implement strict conditional access

• Require managed devices: Block any login attempt not coming from a corporate-enrolled device (via Intune/Jamf).

• Enforce geofencing: Block traffic from high-risk regions or countries outside your operational footprint.

• Flag impossible travel: Trigger immediate alerts for sessions that jump vast distances faster than a plane can fly.

Harden session integrity

• Enable token binding: Lock session tokens to the specific TLS connection; stolen cookies become useless on an attacker's machine.

• Shorten session lifespans: Force frequent re-authentication to shrink the "window of opportunity" for stolen tokens.

• Use Continuous Access Evaluation (CAE): Kill active sessions instantly if a user's IP changes or risk levels spike.

Strengthen network & email defenses

• DNS filtering: Automatically block "newly registered domains" to stop fresh phishing links in their tracks.

• AI-driven email security: Use tools like Cloudflare to identify real-time infrastructure fingerprints.

• Sandboxing & deep inspection: Detonate links in isolated environments to expose hidden redirects before they reach the user.

• Strict DMARC/SPF/DKIM: Move to a "Reject" policy to prevent brand spoofing and unauthorized sender impersonation.

In addition, we provide all organizations (whether a Cloudflare customer or not) with free access to our email Retro Scan tool, allowing them to use our predictive AI models to scan existing inbox messages. Retro Scan will detect and highlight any threats found, enabling organizations to remediate them directly in their email accounts. With these insights, organizations can implement further controls, either using Cloudflare Email Security or their preferred solution, to prevent similar threats from reaching their inboxes in the future.