Microsoft Leads Takedown of Phishing Network That Sent Over a Billion Messages

Microsoft led a coordinated international takedown of a massive cybercrime marketplace known as YAM Store, according to a recent report. The operation involved private cybersecurity firms and law enforcement agencies, resulting in the seizure of domains and thousands of compromised accounts used to distribute fraudulent content.

The investigation uncovered that the underground store facilitated the sale of stolen digital accounts, web hosting services, and specialized tools for creating spoofed websites. Researchers found that threat actors used these resources to launch large-scale phishing campaigns targeting organizations and individuals across multiple countries, including the United States and Japan.

Origins and Investigation Scope

The probe began late last year after Japan’s National Police Agency alerted Microsoft to a surge in fraud and scam activity targeting local businesses and citizens. Microsoft researchers followed the trail from what initially appeared to be a standard phishing campaign to a sprawling Chinese-language marketplace. This discovery revealed a complex ecosystem where criminals bought and sold the infrastructure necessary for sustained cybercriminal operations.

According to TechRadar, the marketplace offered fraudulent Microsoft and Google accounts alongside ready-made tools for credential theft. The sheer scale of the operation allowed attackers to bypass traditional detection methods by using pre-built, high-quality impersonation materials rather than crafting unique scams for each victim.

Tools Used in the Campaign

Two specific platforms, CoGUI and Iron Man, emerged as central to the operation’s success. CoGUI functioned as a website-building framework that supplied criminals with ready-made pages impersonating trusted entities such as banks, government agencies, and major corporations. This tool allowed attackers to deploy credential-stealing sites rapidly without needing advanced technical skills.

Iron Man later expanded this model by providing a gallery of thousands of templates tailored to specific brands, industries, and countries. By mid-2026, researchers noted that Iron Man was steadily replacing CoGUI as the primary tool in the ecosystem. This shift enabled criminals to customize email, text, and web content more effectively, increasing the likelihood of successful deception.

Impact on Global Targets

The operation drove the distribution of over one billion phishing messages before authorities could intervene. These messages targeted victims primarily in Japan and the United States, leveraging the impersonation tools to steal passwords, payment information, and other personal data. The widespread use of these templates made the scams difficult to distinguish from legitimate communications from trusted organizations.

Microsoft explained that the ease of use provided by these tools lowered the barrier to entry for cybercriminals. Instead of developing their own infrastructure, attackers could simply purchase access to CoGUI or Iron Man, allowing them to scale their operations quickly and efficiently across different geographic regions.

What should you do?

Organizations should review their email filtering rules to detect sophisticated impersonation attempts. Security teams should monitor for unusual login patterns that may indicate the use of stolen accounts purchased from underground markets. Users should verify the authenticity of unexpected requests for sensitive information, especially those involving financial transactions or account credentials.

What to do and how to stay safe: Microsoft

• Monitor email logs for high volumes of messages from unknown domains that mimic trusted brands.
• Implement multi-factor authentication to protect accounts even if credentials are stolen via phishing.
• Train employees to recognize generic but polished phishing templates that may lack specific personal details.
• Report suspicious messages to internal security teams to help identify emerging campaign patterns.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What was the name of the cybercrime marketplace taken down?

The marketplace was called YAM Store, which sold phishing tools and stolen accounts.

How many phishing messages were sent by this network?

The operation drove over one billion phishing messages before the takedown.

Which tools were used to create the phishing content?

Criminals used CoGUI and Iron Man to create spoofed websites and tailored messages.