Microsoft says it helped disrupt a sprawling phishing operation linked to more than one billion malicious messages, working with Japan’s National Police Agency to target the marketplace and tools behind the campaign. The operation centered on YAM Store and two phishing kits, CoGUI and Iron Man—an entire supply chain for scam messages, because apparently fraud also needed a software marketplace.
According to Microsoft, since January 2026, the three platforms have enabled more than one billion messages targeting over 75,000 organizations worldwide. More than 750 million messages targeted Microsoft customers. The scams reached consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, and generated tens of millions of dollars for the operators, Microsoft says.
The platforms lowered the barrier to running those campaigns. Microsoft says scammers could buy stolen or fraudulent Microsoft and Google accounts through YAM Store, then use CoGUI or Iron Man to send phishing messages. The kits offered ready-made ways to impersonate legitimate organizations, sparing criminals the inconvenience of having to build their own convincing-looking scams from scratch.
YAM Store also allegedly used expired web domains belonging to real organizations and created websites for nonexistent ones. Microsoft says those sites helped the operation obtain Microsoft accounts for resale. Iron Man, meanwhile, offered more than 2,300 templates designed to mimic organizations including banks and police departments. The familiar fake delivery notice or bogus parking fine may look like low-effort spam; behind some of it, the infrastructure was considerably more organized.
Microsoft says it disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 web domains used for impersonation and fraud. Working with Health-ISAC, a nonprofit focused on cybersecurity in the health sector, it also seized and redirected domains powering all three platforms.
Those actions target the machinery used to run the scams, not just individual messages after they arrive. But a takedown is not a guarantee that scam texts will disappear: the figures describe activity enabled by the platforms, and the supplied information does not establish how many messages were actually delivered or how many victims were affected. Nor does it show whether the operators can rebuild their services elsewhere.
Still, removing accounts, domains and services at this scale is a meaningful disruption. The less comforting lesson is that phishing has become a service business, complete with account inventories and thousands of impersonation templates. The message in your inbox may be fake; the industrial plumbing behind it is very real.
Sources: Glitch Please! and The Verge — https://www.theverge.com/tech/1011487/microsoft-scam-messages-marketplace-takedown — Reporting by Stevie Bonifield
Generated by AI
