Microsoft, Japan dismantle scam network behind billions of phishing messages
What's the story
Microsoft has announced the dismantling of a major cybercrime network responsible for sending out over a billion phishing messages. The operation was carried out in collaboration with Japan's National Police Agency. The investigation led to the discovery of a marketplace known as YAM Store and two phishing kits, CoGUI and Iron Man, which were used to spread these malicious messages globally.
Scam operations
Phishing campaigns targeted Microsoft customers globally
Since January 2026, the YAM Store, along with the CoGUI and Iron Man kits, has been behind over a billion malicious messages. These messages targeted more than 75,000 organizations worldwide.
Over 750 million of these were aimed at Microsoft customers alone. The phishing campaigns targeted consumers and businesses across sectors like healthcare and finance in over 150 countries.
They reportedly generated tens of millions of dollars for their operators.
Scam tactics
Scammers used YAM Store to buy fake Microsoft, Google accounts
The Microsoft report revealed that scammers used the YAM Store to purchase stolen or fake Microsoft and Google accounts. The phishing kits were then used to send out scam messages.
The YAM Store also exploited expired web domains of legitimate organizations, creating fake websites for non-existent ones.
This tactic was used to acquire Microsoft accounts, which were later resold on the marketplace.
Phishing tools
Over 2,300 templates available on Iron Man platform for impersonation
The Iron Man platform offered over 2,300 templates that scammers could use to impersonate legitimate organizations such as banks and police departments.
In response to these cyber threats, Microsoft has disabled over 20,000 accounts linked to the YAM Store.
The tech giant also blocked more than 100,000 web domains used for impersonation and fraud.