Microsoft and Japan disrupt scam-message marketplace
Microsoft and Japan's National Police Agency helped dismantle a scam marketplace called YAM Store and two phishing kits, CoGUI and Iron Man. Authorities say the operation sent more than a billion malicious messages to over 75,000 organizations and disabled over 20,000 accounts. Scammers used stolen or fraudulent accounts and hijacked expired domains to resell Microsoft accounts, according to Microsoft.
The takedown followed a joint probe by Microsoft and Japan’s National Police Agency. Investigators linked the activity to YAM Store and phishing kits CoGUI and Iron Man. From January 2026, these tools reportedly powered over a billion malicious messages aimed at more than 75,000 organizations across over 150 countries.
More than 750 million targeted Microsoft customers, generating tens of millions of dollars. Accounts for Microsoft and Google were available after being stolen or fraudulently obtained, while expired domains were hijacked and fake organizations created to obtain resellable Microsoft accounts. Iron Man offered over 2,300 impersonation templates. Microsoft disabled over 20,000 accounts, blocked over 100,000 domains, and worked with Health-ISAC to seize and redirect platform domains.
This disruption may reduce some phishing texts and emails reaching consumers, patients, bank customers, and employees, at least temporarily. Fewer stolen accounts and impersonation domains could make it harder for scammers to scale campaigns, though criminal groups may adapt or move to other marketplaces. Organizations named in the report, especially healthcare and financial targets, could see lower exposure, while Microsoft account holders may face fewer credential-theft attempts. The long-term effect depends on whether authorities sustain pressure and whether remaining infrastructure is rebuilt.