A joint operation between Microsoft and Japan’s National Police Agency has led to the dismantling of a marketplace used by scammers to send phishing messages. The network, known as YAM Store, provided tools and accounts that enabled scammers to launch over one billion malicious messages since January 2026. These messages targeted organizations across more than 150 countries, including Microsoft customers, financial institutions, and healthcare providers.
The operation uncovered a sophisticated system where scammers could purchase stolen Microsoft and Google accounts on YAM Store. They also used phishing kits like CoGUI and Iron Man to send fraudulent messages. The Iron Man platform offered over 2,300 templates to mimic legitimate organizations such as banks and police departments, making scams more convincing.
Microsoft disabled over 20,000 accounts linked to YAM Store and blocked more than 100,000 web domains used for impersonation and fraud. In collaboration with the health cybersecurity nonprofit Health-ISAC, Microsoft also seized and redirected web domains powering the platforms. This effort aims to disrupt the infrastructure used by cybercriminals to exploit users and organizations worldwide.
The takedown highlights the growing threat of organized cybercrime and the need for international cooperation to combat it. Microsoft’s actions demonstrate a proactive approach to protecting users and reducing the spread of phishing attacks that can lead to significant financial and reputational damage.