Microsoft and Japan's police agency dismantle phishing marketplace tied to over a billion scam messages

The company said the activity traced back to a marketplace called YAM Store and two phishing kits, CoGUI and Iron Man. Since January 2026, Microsoft says, the three operations collectively enabled more than one billion malicious messages aimed at over 75,000 organizations, including more than 750 million messages directed at Microsoft customers alone.

The messages were used to target consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for the people running the platforms, according to Microsoft's report.

Scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and then use the phishing kits to send their messages, the report says. Microsoft said YAM Store also hijacked expired web domains belonging to real organizations and built websites for organizations that did not exist, which it used to obtain Microsoft accounts that it later resold.

Iron Man separately offered more than 2,300 templates that scammers could use to impersonate banks, police departments and other organizations, Microsoft said.

Microsoft said it disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 web domains that were being used for impersonation and fraud. Working with Health-ISAC, a nonprofit focused on cybersecurity in the health sector, the company also seized and redirected the web domains that powered all three platforms.

The takedown addresses a category of messages familiar to many phone users, including texts about nonexistent parking tickets or fake package deliveries. Microsoft's investigation with Japan's National Police Agency traced the infrastructure behind those campaigns to the marketplace and the two kits.