Microsoft and Japanese authorities dismantle billion-message phishing marketplace
Microsoft and Japan's National Police Agency shut down YAM Store and related phishing kits that sent over one billion scam messages globally since January 2026.
What happened
Microsoft and Japan's National Police Agency dismantled YAM Store, a marketplace for scammers, along with two phishing kits called CoGUI and Iron Man. Since January 2026, these platforms collectively sent over one billion malicious messages targeting more than 75,000 organizations across 150+ countries, including 750 million messages aimed at Microsoft customers. The marketplace sold stolen or fraudulent Microsoft and Google accounts, hijacked expired web domains of real organizations, and created fake organization websites. Iron Man offered over 2,300 templates for impersonating banks and police departments. Microsoft disabled over 20,000 accounts, blocked over 100,000 malicious web domains, and with Health-ISAC, seized and redirected domains powering all three platforms.
Context
The scale and reach of this operation—generating tens of millions of dollars across 150 countries and targeting consumers, healthcare organizations, and financial institutions—demonstrates the infrastructure supporting mass phishing campaigns. The reliance on marketplace-based account and domain sales, along with ready-made impersonation templates, indicates how organized cybercriminal activity has become industrialized. Disrupting these platforms removes key infrastructure that scammers depend on to reach scale, though the continued prevalence of phishing suggests similar operations remain active.