Microsoft and Japanese police helped dismantle scam network — The Verge

Microsoft said it had helped dismantle infrastructure used for phishing campaigns in various countries together with Japan’s National Police Agency. The investigation led to the YAM Store marketplace and two phishing toolkits — CoGUI and Iron Man, The Verge reports.

More than one billion malicious messages

According to Microsoft, since January 2026, YAM Store, CoGUI, and Iron Man have collectively facilitated the sending of more than 1 billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of them targeted Microsoft customers.

These messages were sent to consumers, healthcare institutions, financial organizations, and other companies in more than 150 countries. Microsoft said this activity had generated tens of millions of dollars for the platforms’ operators.

More current news is available on the UA.News Telegram channel Telegram.

Sale of accounts and templates

According to Microsoft’s report, at YAM Store, fraudsters could purchase stolen or fraudulent Microsoft and Google accounts and then use phishing kits to send messages. The company also claims that the marketplace took over the domains of real organizations after their registrations expired and created websites of nonexistent organizations to obtain Microsoft accounts for subsequent sale.

The Iron Man platform offered more than 2,300 templates for impersonating banks, police agencies, and other organizations. Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and blocked more than 100,000 domains used to impersonate organizations and commit fraud. Together with the nonprofit organization Health-ISAC, the company also seized and redirected domains that enabled all three platforms to operate.