Microsoft and Japan Dismantle Phishing Network Behind Over 1B Scam Messages

Microsoft and Japan’s National Police Agency helped dismantle the YAM Store scam marketplace alongside the CoGUI and Iron Man phishing kits, which collectively enabled more than 1B malicious messages since January 2026. Over 750M of those phishing messages were geared toward Microsoft customers alone, targeting over 75,000 organizations and consumers across more than 150 countries and generating tens of millions of dollars for their operators. According to Microsoft, YAM Store sold stolen or fraudulent Microsoft and Google accounts, hijacked expired organizational web domains, and created websites for nonexistent organizations to obtain accounts for resale. The Iron Man platform offered over 2,300 templates allowing scammers to impersonate banks, police departments, and other institutions, while Microsoft disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains used for fraud. Working alongside health sector cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected the web domains powering YAM Store, CoGUI, and Iron Man.