Microsoft announced the takedown of a significant cybercrime infrastructure operation conducted in coordination with Japan’s National Police Agency. The investigation focused on YAM Store, an online marketplace for scammers, along with two phishing toolkit platforms designated CoGUI and Iron Man.
The three platforms collectively facilitated the distribution of more than one billion malicious messages beginning in January 2026. The campaign targeted in excess of 75,000 organizations globally, with over 750 million messages specifically aimed at Microsoft customers. The phishing efforts reached potential victims across more than 150 countries and are believed to have generated tens of millions of dollars for the criminal operators behind the scheme.
According to Microsoft’s findings, the YAM Store marketplace functioned as a hub where criminals could purchase compromised or fraudulent accounts belonging to Microsoft and Google. Purchasers then utilized the CoGUI and Iron Man phishing kits to distribute deceptive messages at scale. The marketplace also engaged in domain hijacking, repurposing expired web addresses belonging to legitimate organizations and establishing fraudulent websites impersonating nonexistent entities to acquire additional Microsoft accounts for resale.
The Iron Man platform provided scammers with an extensive library of over 2,300 customizable message templates designed to impersonate recognized institutions, including financial organizations and law enforcement agencies. In response to the investigation’s findings, Microsoft disabled more than 20,000 accounts associated with YAM Store and blocked over 100,000 web domains involved in the impersonation and fraud operations. The company collaborated with Health-ISAC, a health sector cybersecurity organization, to seize control of and redirect the web domains supporting all three criminal platforms.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI