Microsoft and Japan took down a cybercrime network behind over a billion scam messages
We've all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you'll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan's National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI…
Key points
- Microsoft and Japan's National Police Agency dismantled a cybercrime network behind over a billion scam messages.
- The operation targeted YAM Store and phishing kits CoGUI and Iron Man, affecting over 75,000 organizations in more than 150 countries.
- Microsoft disabled over 20,000 accounts and blocked over 100,000 web domains, and seized and redirected domains with Health-ISAC.
Microsoft announced it helped dismantle a cybercrime marketplace that enabled more than one billion phishing messages. The operation was conducted with Japan's National Police Agency.
The investigation traced the scams to a marketplace called YAM Store and two phishing kits, CoGUI and Iron Man. Since January 2026, these tools have collectively powered over a billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million aimed at Microsoft customers.
Global reach and financial impact
The messages targeted consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries. According to Microsoft's report, the operators generated tens of millions of dollars from these activities.
Scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages. The Iron Man platform also offered over 2,300 templates for impersonating organizations like banks and police departments.
Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers.
— Microsoft
Microsoft's enforcement actions
Microsoft disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains used for impersonation and fraud. The company also seized and redirected web domains that powered all three platforms, working with the health sector cybersecurity non-profit Health-ISAC.
YAM Store additionally hijacked real organizations' expired web domains and created websites for nonexistent organizations, which it used to obtain Microsoft accounts for resale.
