Microsoft and Japan's National Police Dismantle Massive Cybercrime Network Behind Over One Billion Scam Messages

Image: Two side-by-side screenshots of Amazon Japan webpages. The left shows an Amazon.co.jp login page with email and password fields. The right shows a payment method update page with fields for cardholder name, card number, expiration date, and security · Source

Microsoft and Japan's National Police Agency collaborated to take down a large cybercrime marketplace enabling over one billion phishing and scam messages worldwide, disrupting services that supplied criminals with stolen accounts, phishing kits, and fraudulent domains.

Scam text messages warning of fake parking tickets, deliveries, or unpaid bills are ubiquitous annoyances, but recent efforts by Microsoft and Japan's National Police Agency (NPA) promise to reduce their prevalence significantly. In late 2025, the NPA alerted Microsoft to targeted scam campaigns affecting Japanese residents, which led to an extensive investigation revealing a vast Chinese-language cybercrime marketplace facilitating global phishing operations.

This marketplace centered on three key components: YAM Store, CoGUI, and Iron Man. Since January 2026, these platforms collectively facilitated the distribution of over one billion malicious messages aimed at more than 75,000 organizations worldwide, including upwards of 750 million messages targeting Microsoft customers alone. Victims ranged from everyday consumers to healthcare providers, financial institutions, and various businesses across more than 150 countries.

YAM Store operated as an illicit online shop where criminals could purchase stolen or fraudulent Microsoft and Google accounts, alongside tools used to execute scams. The marketplace also hijacked expired web domains belonging to legitimate organizations, recreating authentic-looking websites to fraudulently obtain Microsoft 365 accounts for resale. Complementing YAM Store, the CoGUI phishing kit provided ready-made websites and messaging templates impersonating trusted companies, banks, and government agencies for rapid deployment.

As these tools evolved, the Iron Man platform emerged, offering over 2,300 phishing templates tailored to mimic an extensive array of entities—ranging from banks and retailers to police departments and government agencies—across multiple industries and countries. Iron Man enabled fraudsters to customize fraudulent email, text, and web content with a high degree of sophistication, increasing the effectiveness of their scams.

This transnational investigation brought together expertise and intelligence from multiple organizations, including the Japan Cybercrime Control Center, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, and international law enforcement agencies such as the U.S. Secret Service. Utilizing AI tools and collaborative intelligence sharing, investigators linked disparate accounts, websites, and infrastructure to expose the scale and complexity of the criminal ecosystem.

In mid-October 2026, supported by a U.S. District Court order, Microsoft and Health-ISAC seized and redirected domains underpinning the three platforms and disabled over 20,000 accounts related to YAM Store. Over 100,000 fraudulent web domains used for impersonation and fraud were blocked, disrupting the scam supply chain and considerably raising the barrier for cybercriminals seeking to exploit consumers and businesses.

This takedown highlights a growing trend in cybercrime where sophisticated service economies supply criminals with turnkey tools and infrastructure to perpetrate fraud at a massive scale. While YAM Store, CoGUI, and Iron Man represent only a segment of this underground network, dismantling them significantly impedes the global dissemination of scam messages, protecting millions of potential victims.

Microsoft's Digital Crimes Unit offers further resources and recommendations for users to safeguard against phishing attempts, emphasizing the importance of ongoing vigilance amid an evolving cyber threat landscape.