Microsoft and Japan dismantle YAM Store scam network
Microsoft and Japan's National Police Agency took down the YAM Store cybercrime network, disabling over 20,000 accounts after blocking a billion scam messages.
Stock photo for illustration only, not from the actual event
- Microsoft partnered with Japanese police to dismantle the YAM Store marketplace.
- The cybercrime network drove over one billion scam messages since January 2026.
- The operation disabled more than 20,000 associated accounts and blocked domains.
We have all encountered deceptive text messages regarding unpaid parking tickets or missing package deliveries, but users may soon notice a decrease in these annoyances. Microsoft recently revealed a successful collaborative operation with Japan's National Police Agency to dismantle an underground marketplace fueling scammers worldwide. The joint investigation targeted a scam hub called YAM Store alongside two phishing kits named CoGUI and Iron Man.
According to findings, YAM Store, CoGUI, and Iron Man collectively facilitated over one billion malicious messages targeting more than 75,000 organizations globally since January 2026. This includes upwards of 750 million messages specifically aimed at Microsoft customers. These fraudulent texts targeted consumers, healthcare facilities, financial institutions, and other businesses across more than 150 countries, generating tens of millions of dollars for the operators.
Stock photo for illustration only, not from the actual event
Microsoft's report outlines how cybercriminals purchased stolen or fraudulent Microsoft and Google accounts on YAM Store to distribute phishing messages using the provided kits. Furthermore, YAM Store hijacked expired web domains from legitimate organizations and created fake entity websites to acquire new Microsoft accounts for resale.
Meanwhile, the Iron Man platform offered over 2,300 templates allowing bad actors to impersonate trusted entities like banks and law enforcement agencies. In response, Microsoft disabled more than 20,000 accounts linked to YAM Store and blocked over 100,000 web domains utilized for impersonation and fraud.
The dismantling of YAM Store, CoGUI, and Iron Man highlights a crucial shift toward neutralizing the core infrastructure of cybercrime networks. Traditional defenses often focus on filtering individual messages or blocking phone numbers, but targeting the marketplace ecosystem disrupts the operational backbone that supplies scammers with stolen credentials and ready-to-use phishing templates.
Working alongside the healthcare cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected web domains previously powering all three illicit platforms to curb ongoing threats.
Source: The Verge
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment