Microsoft and Japan Dismantle Global Cybercrime Phishing Network
Joint operation neutralizes YAM Store, CoGUI, and Iron Man phishing infrastructures.
1Coordinated Global Security Operation
Microsoft collaborated with Japan’s National Police Agency to dismantle a massive cybercrime network. The investigation targeted the YAM Store marketplace alongside phishing kits known as CoGUI and Iron Man. This joint effort successfully disrupted operations that had been active since January 2026, marking a significant intervention against global phishing campaigns.
2Scale of Malicious Activity
The infrastructure enabled over one billion malicious messages targeting more than 75,000 organizations globally. Microsoft customers were primary targets, receiving over 750 million of these fraudulent communications. These campaigns spanned more than 150 countries, impacting diverse sectors including healthcare, financial institutions, and various businesses while generating millions in illicit revenue.
3Marketplace Operational Mechanics
YAM Store functioned as a hub for purchasing stolen or fraudulent Microsoft and Google accounts. The platform also hijacked expired web domains from legitimate organizations to host phishing sites. By creating fake entities and reselling compromised accounts, the operators maintained a persistent presence that facilitated widespread impersonation and credential theft.
4Phishing Kit Capabilities
The Iron Man platform provided scammers with over 2,300 templates designed to impersonate trusted entities. These templates allowed attackers to mimic banks and police departments with high precision. By leveraging these kits, malicious actors could easily launch sophisticated phishing attacks that appeared authentic, significantly increasing the success rate of their fraudulent schemes.
5Direct Remediation Actions
Microsoft disabled over 20,000 accounts directly linked to the YAM Store marketplace. Furthermore, the company blocked more than 100,000 web domains previously used for impersonation and fraud. These technical measures were essential to cutting off the attackers' access to their victim base and preventing further exploitation of compromised organizational credentials.
6Strategic Domain Seizure
In partnership with the non-profit Health-ISAC, Microsoft seized and redirected web domains that powered the YAM Store, CoGUI, and Iron Man platforms. This redirection strategy effectively neutralized the command-and-control infrastructure. By taking control of these domains, the organizations prevented the scammers from continuing their phishing operations or accessing their existing malicious assets.
7Impact on Targeted Sectors
The phishing network specifically targeted critical infrastructure, including healthcare and financial sectors, across 150 countries. By impersonating police and banking institutions, the attackers exploited institutional trust to deceive consumers and employees. The scale of this operation highlights the severe risks posed by automated phishing kits when deployed against global organizational networks.
8Future Security Implications
The successful takedown demonstrates the effectiveness of public-private partnerships in combating organized cybercrime. While this specific network is dismantled, the reliance on automated phishing kits remains a persistent threat. Organizations must continue monitoring for domain hijacking and account compromise to mitigate the risks posed by similar future marketplace-based cyber threats.
Original article: The Verge — Microsoft and Japan Dismantle Global Cybercrime Phishing Network