Microsoft Leads Global Takedown of Phishing Marketplace Behind Over a Billion Messages

The investigation began after Japan's National Police Agency alerted Microsoft to a wave of fraud and scam activity targeting individuals and businesses in Japan. Microsoft researchers said they found YAM Store, an underground marketplace where fraudulent Microsoft and Google accounts were offered for sale along with ready-made tools for scams and credential theft. Two tools stood out: CoGUI, described as a website building framework, and Iron Man, a template gallery.

Microsoft said CoGUI supplied criminals with ready-made websites and messages impersonating companies, financial institutions, government agencies and other trusted organizations. Rather than building fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information and other personal data. Researchers said CoGUI became one of the most widely used offerings in the ecosystem, mainly for targeting victims in Japan and the United States, but by mid-2026 it was steadily being replaced by Iron Man.

Iron Man expanded the model by giving criminals access to thousands of ready-made templates designed to impersonate trusted organizations, according to Microsoft. The tool offered more than 2,300 templates of banks, retailers, healthcare providers, police departments and other organizations in more than 150 countries. Criminals could use them to quickly deploy email, text and web content tailored to specific brands, industries and countries. Microsoft said the store and its offerings were popular in the cybercriminal community and this year facilitated more than a billion phishing messages aimed at 75,000 organizations worldwide. Microsoft customers alone received more than 750 million of those messages since the start of the year, and the attacks generated tens of millions of dollars in profit for the operators.

Microsoft said it and Health-ISAC, a global nonprofit that helps healthcare firms share cyber intelligence, seized and redirected the domains leading to YAM Store, CoGUI and Iron Man. Microsoft also disabled more than 20,000 accounts connected to the store and said it continues to dismantle the operation by removing infrastructure hosted on its services. The action has so far blocked more than 100,000 domains used for impersonation and fraud, according to the company.

Researchers said the case began with scam activity in Japan but led investigators to an underground service economy supplying criminals around the world. They said YAM Store, CoGUI and Iron Man are only part of a larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.

TechRadar reported that tearing down the infrastructure without arrests leaves open the possibility that the marketplace will re-emerge. As a comparison, the report noted that when law enforcement agencies took down the platforms Cracked and Nulled in early 2025, they arrested two suspects and seized 17 servers and more than 50 electronic devices. Those forums, which offered illegal goods and cybercrime-as-a-service, had more than 10 million users in total, and investigators estimated the arrested suspects earned more than a million dollars in criminal profits.

Editor's Summary

Microsoft led a takedown of the YAM Store, CoGUI and Iron Man phishing marketplace with Proofpoint, Health-ISAC and Japanese law enforcement, seizing domains and disabling more than 20,000 accounts. Microsoft says the network facilitated over a billion phishing messages this year and targeted 75,000 organizations. The operation blocked more than 100,000 domains, though the absence of arrests leaves open the risk that similar services could return.