Microsoft-led action disrupts phishing network behind over a billion messages

Microsoft says it has helped disrupt YAM Store, a Chinese-language cybercrime marketplace linked to phishing campaigns around the world. The company began investigating after Japan’s National Police Agency alerted it to fraud targeting people and businesses in Japan.

Researchers found stolen Microsoft and Google accounts for sale alongside tools for building spoofed sites and messages. Two offerings stood out: CoGUI, a website-building framework, and Iron Man, a template gallery. Microsoft said Iron Man offered more than 2,300 templates impersonating organizations in more than 150 countries.

The marketplace’s tools facilitated more than a billion phishing messages aimed at 75,000 organizations this year, according to Microsoft. Microsoft customers received more than 750 million of those messages since the start of the year. The company said the attacks generated “tens of millions of dollars” in profit for the operators.

Following an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains linked to YAM Store, CoGUI, and Iron Man. Microsoft also disabled more than 20,000 connected accounts and said the action has blocked more than 100,000 domains used for impersonation and fraud.

Microsoft said it continues removing infrastructure hosted on its services. The source report notes that the takedown announcement did not mention arrests.