Microsoft and Japan take down cybercrime network behind over a billion scam messages
Microsoft, working with Japan's National Police Agency, has dismantled the YAM Store scam marketplace and two phishing kits, CoGUI and Iron Man. Since January 2026 they enabled more than one billion malicious messages worldwide.
Technology company Microsoft says it helped dismantle an online marketplace where scammers bought tools for sending phishing messages, working together with Japan's National Police Agency. Phishing is a type of fraud in which fake messages, such as ones about a nonexistent parking ticket or a package delivery, try to trick people into giving up data or paying money. The investigation led to a marketplace called YAM Store and two phishing kits, CoGUI and Iron Man.
Scale
Microsoft says that since January 2026 the three services have enabled more than one billion malicious messages aimed at over 75,000 organizations worldwide. More than 750 million of them targeted Microsoft customers. Victims included consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, and the operators earned tens of millions of dollars.
How it worked
According to Microsoft's report, YAM Store sold stolen or fraudulent Microsoft and Google accounts, while the phishing kits were used to send the messages. YAM Store also hijacked expired web domains belonging to real organizations and built websites for nonexistent ones, using them to obtain Microsoft accounts that could be resold. The Iron Man platform offered more than 2,300 templates for impersonating organizations such as banks and police departments.
Actions taken
Microsoft disabled over 20,000 accounts linked to YAM Store and blocked more than 100,000 web domains used for impersonation and fraud. Together with Health-ISAC, a cybersecurity non-profit for the health sector, it also seized and redirected the domains that powered all three platforms.
