Microsoft and Japan Disrupt Network Behind More Than 1 Billion Scam Messages

Microsoft says it helped dismantle a marketplace and two phishing kits that enabled scammers to send more than 1 billion malicious messages since January 2026. The operation followed an investigation with Japan’s National Police Agency, which traced activity to YAM Store and the CoGUI and Iron Man phishing kits.

According to Microsoft, the three platforms’ messages targeted more than 75,000 organizations worldwide. More than 750 million messages targeted Microsoft customers alone. The campaigns reached consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.

Microsoft says scammers could buy stolen or fraudulent Microsoft and Google accounts through YAM Store and use the kits to send phishing messages. The marketplace also hijacked expired web domains belonging to real organizations and created sites for nonexistent ones to obtain Microsoft accounts for resale. Iron Man offered more than 2,300 templates for impersonating organizations such as banks and police departments.

Microsoft says it disabled more than 20,000 accounts linked to YAM Store and blocked more than 100,000 web domains used for impersonation and fraud. Working with Health-ISAC, a nonprofit focused on cybersecurity in the health sector, it also seized and redirected domains powering all three platforms.