Microsoft and Japan Dismantle YAM Store Phishing Marketplace

Microsoft disabled over 20,000 accounts connected to the YAM Store, a cybercrime marketplace that facilitated more than one billion malicious messages. This action followed a nearly year-long investigation conducted jointly with Japan’s National Police Agency, according to reports from The Verge and CSO Online.

The dismantling effort targeted a coordinated network dealing in commercial phishing-as-a-service. Microsoft’s Digital Crimes Unit worked with international authorities to expose the infrastructure behind these scams. Steven Masada, associate general counsel for Microsoft, noted that AI tools helped connect seemingly unrelated accounts and websites to reveal the broader operation.

Investigation Background

The probe began in late 2025 after Japan’s National Police Agency alerted Microsoft to a surge in fraud targeting people and businesses in Japan. Researchers initially expected to find isolated campaigns but instead uncovered a sprawling Chinese-language marketplace. The investigation expanded globally and involved partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, according to CSO Online.

YAM Store functioned as an initial access broker, allowing criminals to browse and purchase fraudulent Microsoft and Google accounts. Customers could buy pre-made phishing kits, including CoGUI and Iron Man, to deploy attacks quickly. The marketplace organized tools by age, subscription type, and environment, such as .edu or .org sites.

Scope and Impact

Since January 2026, the YAM Store and its associated kits enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of those messages were directed at Microsoft customers alone. The scams targeted consumers, healthcare organizations, and financial institutions in more than 150 countries, generating tens of millions of dollars for operators.

The Iron Man platform offered over 2,300 templates for impersonating banks and police departments. YAM Store hijacked expired web domains from legitimate organizations to create fake sites for nonexistent entities, which it used to get Microsoft accounts for resale, according to The Verge.

Microsoft blocked over 100,000 web domains used for fraud and impersonation. Along with the Health-ISAC non-profit, Microsoft seized and redirected domains powering the YAM Store, CoGUI, and Iron Man platforms. These actions aim to disrupt the infrastructure supporting the phishing-as-a-service model.

What should you do?

Organizations should review their domain expiration dates to prevent criminals from registering lapsed addresses. Security teams should monitor for unexpected login attempts from new or suspicious accounts. Users should remain vigilant against messages claiming to be from banks or delivery services.

What to do and how to stay safe: Microsoft

• Audit domain portfolios to ensure timely renewals and prevent hijacking by bad actors.
• Implement strict monitoring for anomalous account creation or login patterns.
• Train staff to verify the authenticity of urgent messages via separate channels.
• Review email filtering rules to catch impersonation attempts from similar-looking domains.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What was the YAM Store?

It was a cybercrime marketplace that sold fraudulent accounts and phishing kits, enabling over one billion scam messages.

How many messages targeted Microsoft customers?

More than 750 million of the one billion malicious messages were sent specifically to Microsoft customers.

Did Microsoft release a patch for this?

No software patch is mentioned; Microsoft disabled accounts and blocked domains to disrupt the criminal infrastructure.