The short version
- The takedown involved Microsoft working with Japan’s National Police Agency to disrupt a major hub for digital fraud.
- The network enabled scammers to send malicious messages targeting more than 75,000 organizations across 150 countries since early 2026.
- Authorities disabled thousands of accounts and blocked hundreds of thousands of domains used for impersonation and account theft.
A significant cybercrime infrastructure has been dismantled following a coordinated effort between Microsoft and law enforcement officials in Japan. The operation targeted a digital marketplace known as YAM Store, which served as a central hub for scammers seeking to launch large-scale phishing campaigns. This network was responsible for facilitating the distribution of more than one billion malicious messages worldwide since January 2026. The scale of the operation indicates a highly organized system designed to exploit vulnerabilities in communication channels and identity verification processes.
The investigation revealed that YAM Store operated alongside two specific phishing kits, identified as CoGUI and Iron Man. These tools allowed criminals to automate the creation and distribution of fraudulent messages. The primary targets included consumers, healthcare providers, financial institutions, and various other businesses. Microsoft reported that over 750 million of these malicious messages were specifically directed at its own customers, highlighting the platform's reliance on compromised credentials within the Microsoft ecosystem. The remaining messages targeted users across a broader spectrum of digital services.
The economic impact of this network was substantial, with operators generating tens of millions of dollars through their activities. Scammers utilized YAM Store to purchase stolen or fraudulent accounts from major tech companies, including Microsoft and Google. These acquired identities were then used to lend credibility to phishing attempts, making them more likely to succeed. The marketplace also engaged in domain hijacking, taking control of expired web domains belonging to legitimate organizations. Additionally, the operators created websites for nonexistent entities to facilitate the creation of new, fraudulent accounts that could be resold on the platform.
The Iron Man component of this network provided scammers with a vast library of over 2,300 templates. These templates were designed to help criminals impersonate trusted institutions such as banks and police departments. By using pre-made designs and language, fraudsters could quickly craft convincing messages that urged recipients to take immediate action, often involving the disclosure of sensitive personal information or financial transfers. This standardization of attack vectors allowed for rapid scaling of operations across different regions and victim demographics.
In response to these findings, Microsoft took decisive technical measures to disrupt the network's functionality. The company disabled more than 20,000 accounts that were directly connected to YAM Store activities. Furthermore, it blocked over 100,000 web domains that were being used for impersonation and fraud. These actions aimed to cut off the supply chain of tools and identities that scammers relied upon. The blocking of domains was particularly critical in preventing the continuation of phishing campaigns that depended on specific URLs to host malicious content or collect user data.
The collaboration extended beyond Microsoft and Japanese authorities to include Health-ISAC, a non-profit organization focused on cybersecurity in the health sector. Together, these entities seized and redirected web domains that were powering all three platforms involved in the scheme. This multi-agency approach ensured that the disruption was comprehensive, addressing both the technical infrastructure and the operational aspects of the cybercrime network. The involvement of Health-ISAC underscores the particular threat posed to healthcare organizations, which are frequent targets due to the sensitive nature of patient data.
The geographic reach of this operation was extensive, with victims identified in more than 150 countries. This global footprint suggests that the operators behind YAM Store, CoGUI, and Iron Man had established a sophisticated international distribution network. The ability to target organizations worldwide indicates a level of resource allocation and strategic planning typically associated with large criminal enterprises. The takedown represents a significant blow to this infrastructure, potentially reducing the volume of scam messages seen by users in the coming months.
While the immediate threat from these specific platforms has been neutralized, the broader issue of digital fraud remains persistent. Cybercriminals often adapt quickly to disruptions, seeking new tools and methods to continue their activities. The success of this operation highlights the importance of ongoing collaboration between technology companies and law enforcement agencies. By sharing intelligence and coordinating actions, these entities can more effectively identify and dismantle emerging threats before they cause widespread harm.
For consumers and businesses, the dismantling of YAM Store offers a temporary reprieve from some of the most prevalent phishing tactics. However, vigilance remains essential as scammers continue to evolve their strategies. Organizations are encouraged to review their security protocols and ensure that employees are trained to recognize suspicious communications. The data collected during this investigation will likely inform future defensive measures, helping to strengthen the overall resilience of digital ecosystems against similar attacks.
This case serves as a reminder of the complex interplay between technology, crime, and enforcement in the digital age. As online interactions become increasingly central to daily life, the stakes for security continue to rise. The joint effort by Microsoft, Japanese police, and Health-ISAC demonstrates a proactive approach to combating cybercrime. By addressing the root infrastructure rather than just individual incidents, authorities aim to create a more secure environment for users globally.
Sources behind this briefing
Go to the original reporting
- The Verge↗Microsoft and Japan took down a cybercrime network behind over a billion scam messages
