Microsoft and Japan Dismantled a Scam Marketplace Behind Over a Billion Phishing Messages

Microsoft and Japan’s National Police Agency have dismantled a cybercrime marketplace and two phishing platforms responsible for more than one billion malicious messages sent to targets worldwide.

The operation, announced in October 2026, targeted a marketplace called YAM Store and two phishing kits known as CoGUI and Iron Man. Since January 2026, the three platforms collectively enabled over one billion malicious messages aimed at more than 75,000 organizations across more than 150 countries. More than 750 million of those messages targeted Microsoft customers specifically. The platforms generated tens of millions of dollars for their operators and were used to target consumers, healthcare organizations, financial institutions, and other businesses.

YAM Store functioned as a storefront where scammers could purchase stolen or fraudulent Microsoft and Google accounts. The marketplace also hijacked expired web domains belonging to real organizations and created websites for fictitious ones, using them to obtain Microsoft accounts for resale. The Iron Man phishing kit offered more than 2,300 templates that scammers could use to impersonate organizations including banks and police departments.

In response, Microsoft disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud. Working with health sector cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected web domains that were powering all three platforms.

The takedown could reduce the volume of phishing messages consumers receive — including the fake parking ticket and package delivery texts that have become widespread. With over 75,000 organizations targeted and operations spanning more than 150 countries, the scope of the disrupted network suggests the action may have a meaningful impact on global phishing activity.