Microsoft and Japan dismantle phishing network behind billion scam messages

Summarised from 2 outlets · Updated 15 Oct, 16:20 · Archive

Microsoft and Japan's National Police Agency have dismantled a cybercrime marketplace called YAM Store that was selling phishing tools and stolen accounts. The investigation, conducted with private cybersecurity firms including Proofpoint, began after Japan's National Police Agency tipped Microsoft off about fraud targeting individuals and businesses in the country.

Since January 2026, YAM Store and two phishing kits it hosted called CoGUI and Iron Man collectively enabled more than one billion malicious messages. These targeted over 75,000 organisations worldwide, including more than 750 million messages aimed at Microsoft customers. The messages targeted consumers, healthcare organisations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.

On the marketplace, scammers could buy stolen or fraudulent Microsoft and Google accounts and use the phishing kits to send scam messages impersonating banks and police departments. CoGUI supplied ready-made websites and messages, whilst Iron Man offered over 2,300 templates. YAM Store also hijacked expired web domains belonging to real organisations and created websites for nonexistent ones.

Microsoft disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains used for impersonation and fraud. With health sector cybersecurity non-profit Health-ISAC, it seized and redirected web domains powering all three platforms.

How it is being reported

• 'What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation': Microsoft leads global takedown of phishing network which sent over a billion messagesAn investigation into a phishing campaign led researchers to a sprawling underground store for stolen accounts and criminal activity.TechRadar · 15 Oct, 16:00
• Microsoft and Japan took down a cybercrime network behind over a billion scam messagesWe've all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you'll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan's National Police Agency, it tracked scam activity back to […]The Verge · 14 Oct, 21:03

In this story: Microsoft · Japan National Police Agency · YAM Store · Proofpoint · Health-ISAC

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem