Microsoft and Japan dismantle cybercrime network responsible for over a billion scam messages.

We’ve all received those annoying scam texts about fake parking tickets or phony package deliveries, but it looks like we might see a decline in them soon. Microsoft has announced that it played a key role in taking down a major marketplace used by scammers to distribute phishing messages globally. In collaboration with Japan’s National Police Agency, they traced these scam operations back to a marketplace known as YAM Store, along with two phishing kits named CoGUI and Iron Man.

Since January 2026, YAM Store, CoGUI, and Iron Man have collectively facilitated the sending of over one billion malicious messages, targeting more than 75,000 organizations worldwide. This includes over 750 million messages aimed specifically at Microsoft customers. These scams have affected consumers, healthcare providers, financial institutions, and various businesses across more than 150 countries, raking in tens of millions of dollars for the scammers.

According to Microsoft’s findings, scammers were able to purchase stolen or fake Microsoft and Google accounts through YAM Store and utilize the phishing kits to send out their fraudulent messages. YAM Store also exploited expired web domains of legitimate organizations to create websites for fake entities, which were then used to acquire Microsoft accounts for resale.

The Iron Man platform provided over 2,300 templates for scammers to impersonate legitimate organizations, including banks and law enforcement agencies. Microsoft has taken action by disabling over 20,000 accounts linked to YAM Store and blocking more than 100,000 web domains used for impersonation and fraud. In partnership with the health sector cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected web domains that were supporting all three platforms.