Microsoft and Japanese Authorities Disrupt Phishing Network Behind 1 Billion Scam Messages
A joint operation dismantled the YAM Store marketplace and two phishing kits after disabling 20,000 accounts and blocking 100,000 domains.
Microsoft has collaborated with Japan’s National Police Agency and healthcare cybersecurity non-profit Health-ISAC to dismantle an illicit cybercrime network responsible for sending over one billion scam messages since January 2026, as reported by The Verge (https://www.theverge.com/tech/1011487/microsoft-scam-messages-marketplace-takedown).
The operation targeted an illicit marketplace called YAM Store alongside two phishing kits, CoGUI and Iron Man. According to Microsoft, the three services collectively enabled fraudulent campaigns targeting more than 75,000 organizations across more than 150 countries, generating tens of millions of dollars for their operators. Over 750 million of the malicious messages specifically targeted Microsoft customers.
According to Microsoft's investigation, scammers used YAM Store to purchase stolen or fraudulent Microsoft and Google accounts. To obtain accounts for resale, YAM Store operators hijacked expired domains of legitimate organizations and set up websites for fictitious entities. Scammers then deployed the CoGUI and Iron Man phishing toolkits to distribute fraudulent texts and emails, such as fake delivery alerts and phony parking citations.
The Iron Man toolkit provided scammers with more than 2,300 communication templates designed to impersonate trusted entities, including banking institutions and police departments.
In response, Microsoft disabled more than 20,000 accounts linked to YAM Store and blocked over 100,000 domains used for impersonation and fraud. Working with Health-ISAC, Microsoft also seized and redirected the core web domains that powered YAM Store, CoGUI, and Iron Man.
Sources
Written by
The Company Wire
Inside the companies building what’s next. Reporting on startups, technology, funding and the people shaping them.
