Microsoft and Japan took down a cybercrime network behind over a billion scam messages

You will encounter materially fewer phishing messages about fake deliveries or tickets in your inbox and on your phone.

Microsoft, in collaboration with Japan's National Police Agency, has dismantled a significant cybercrime operation responsible for over a billion scam messages globally since January 2026. The operation targeted over 75,000 organizations, with more than 750 million messages aimed at Microsoft customers. The marketplace, known as YAM Store, alongside phishing kits named CoGUI and Iron Man, facilitated these scams by allowing the purchase of stolen accounts and providing templates for impersonating legitimate entities. These illicit activities generated tens of millions of dollars for the operators. Microsoft and its partners seized and redirected web domains associated with these platforms, disabling over 20,000 related accounts and blocking more than 100,000 fraudulent web domains.

The takedown of the YAM Store ecosystem highlights the growing sophistication of organized cybercrime, where marketplaces readily supply phishing kits and compromised credentials to a wide range of malicious actors. This comprehensive approach, involving the disruption of both the sales platform and the tools themselves, demonstrates a concerted effort by major tech companies and law enforcement to combat these pervasive threats.

This action significantly disrupts a major source of phishing-as-a-service, potentially reducing the volume of attacks in the short term and forcing scammers to seek out or develop new infrastructure. The involvement of a specific government agency, Japan's NPA, also underscores the international cooperation necessary to address cross-border cybercrime and the challenges in prosecuting actors who operate globally.