Microsoft, working with Japan’s National Police Agency, helped dismantle a cybercrime network linked to more than one billion malicious messages sent worldwide since January 2026. The operation targeted a marketplace called YAM Store and two phishing platforms, CoGUI and Iron Man.
According to Microsoft, the network’s tools enabled attacks against more than 75,000 organizations across over 150 countries. The attacks targeted more than 750 million messages at Microsoft customers. The campaigns affected consumers, healthcare organizations, financial institutions, and other businesses, generating tens of millions of dollars for the operators.
How YAM Store Enabled Online Scams
YAM Store operated as an underground marketplace where cybercriminals could purchase stolen or fraudulently obtained Microsoft and Google accounts, along with tools used to carry out phishing attacks.
Microsoft said the marketplace also exploited expired web domains previously owned by legitimate organizations. Criminals rebuilt these websites to appear active. They used them to obtain Microsoft accounts, which they could then resell.
The operation gave criminals ready-made resources to impersonate trusted organizations and trick victims into sharing sensitive information.
Also Read: AI vs. AI Cyber War: How Artificial Intelligence Is Changing Cybersecurity
Iron Man Offered Over 2,300 Phishing Templates
The Iron Man platform offered more than 2,300 templates designed to impersonate organizations, including banks and police departments. These ready-made tools allowed scammers to create fraudulent messages and websites that appeared legitimate.
The platforms helped criminals run attacks at scale without building their own phishing infrastructure from scratch.
Microsoft Blocks 100,000 Fraudulent Domains
As part of the operation, Microsoft disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 web domains associated with impersonation and fraud.
Microsoft also worked with Health-ISAC, a nonprofit focused on cybersecurity in the healthcare sector, to seize and redirect domains powering YAM Store, CoGUI and Iron Man.
The investigation began after Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan. The inquiry later uncovered a broader criminal marketplace that supplies tools and services to scammers worldwide.
The takedown targets the infrastructure supporting these operations, making it harder for criminals to obtain fraudulent accounts, deploy phishing tools, and reach potential victims.