# Microsoft and Japan Dismantle Global Cybercrime Phishing Network Joint operation neutralizes YAM Store and phishing kits responsible for billion-message scam campaign. - **Source:** [The Verge (theverge.com)](https://www.theverge.com) - **Published:** 2026-10-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/6a540155-f55d-47d9-8510-4439a05d606e ## Coordinated Global Security Operation Microsoft collaborated with Japan’s National Police Agency to dismantle the YAM Store, a major marketplace for cybercriminals. This joint investigation successfully tracked malicious activity back to specific phishing kits known as CoGUI and Iron Man. The operation marks a significant effort to reduce the volume of fraudulent messages targeting consumers and organizations worldwide. ## Scale of Malicious Activity Since January 2026, the identified platforms enabled over one billion malicious messages. These campaigns targeted more than 75,000 organizations across 150 countries. Microsoft customers were specifically impacted, receiving over 750 million of these fraudulent communications. The operation generated tens of millions of dollars in illicit revenue for the criminal operators involved in the scheme. ## Marketplace for Stolen Credentials The YAM Store functioned as a hub where scammers purchased stolen or fraudulent Microsoft and Google accounts. Operators utilized these accounts to facilitate phishing campaigns at scale. The platform also hijacked expired web domains from legitimate organizations and created fake websites for nonexistent entities to further their deceptive activities and resell compromised account access. ## Phishing Kit Capabilities The Iron Man platform provided scammers with over 2,300 templates designed to impersonate trusted entities like banks and police departments. These sophisticated tools allowed attackers to craft highly convincing phishing messages. By leveraging these templates, criminals successfully deceived users, leading to widespread credential theft and unauthorized access across various sectors including healthcare and finance. ## Direct Remediation Actions Microsoft took decisive action by disabling over 20,000 accounts directly connected to the YAM Store marketplace. Additionally, the company blocked more than 100,000 web domains that were actively being used for impersonation and fraudulent activities. These technical interventions were critical in cutting off the infrastructure that supported the attackers' ability to distribute phishing content. ## Strategic Domain Seizure In partnership with the cybersecurity non-profit Health-ISAC, Microsoft seized and redirected web domains that powered the YAM Store, CoGUI, and Iron Man platforms. This redirection effectively neutralized the command-and-control infrastructure used by the scammers. By controlling these domains, the organizations prevented further exploitation of the infrastructure to launch new phishing attacks against unsuspecting targets. ## Cross-Sector Impact The phishing campaign targeted a diverse range of sectors, including healthcare organizations, financial institutions, and various other businesses. Because the attackers impersonated legitimate entities, the potential for data breaches and financial loss was significant. This operation highlights the persistent threat posed by organized cybercrime groups that exploit trust in established digital communication channels. ## Future Security Implications The successful takedown of this network demonstrates the effectiveness of public-private partnerships in addressing large-scale cybercrime. While this specific infrastructure is now offline, the reliance on phishing kits remains a persistent challenge for global cybersecurity. Organizations must continue monitoring for impersonation attempts and expired domain exploitation to maintain robust defenses against evolving digital threats. ## Sources covering this story - https://www.theverge.com/tech/1011487/microsoft-scam-messages-marketplace-takedown — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._