Microsoft has teamed up with Japanese authorities to dismantle a massive cybercrime operation responsible for more than one billion phishing messages worldwide since January 2026.
The operation targeted more than 75,000 organizations across over 150 countries, including healthcare providers, financial institutions, businesses, and individual consumers. According to Microsoft, more than 750 million malicious messages were directed at its customers alone, helping cybercriminals generate tens of millions of dollars.
The investigation, conducted with Japan’s National Police Agency, uncovered a Chinese-language cybercrime marketplace known as YAM Store and two phishing platforms called CoGUI and Iron Man. Together, these services provided criminals with the accounts, infrastructure, and ready-made tools needed to launch large-scale online scams.
YAM Store operated like an online shopping platform where cybercriminals could purchase stolen or fraudulently obtained Microsoft and Google accounts. These accounts were then used to distribute phishing messages and carry out other fraudulent activities.
Investigators also discovered that the marketplace exploited expired internet domains previously owned by legitimate organizations. Criminals would rebuild websites to make those organizations appear active and use their identities to obtain Microsoft 365 accounts, which could later be sold to other scammers.
Meanwhile, CoGUI and Iron Man supplied phishing kits that allowed criminals to create convincing fake websites and messages impersonating trusted organizations. The scams commonly involved fraudulent package delivery notifications, unpaid parking tickets, banking alerts, and other urgent payment requests designed to trick victims into revealing personal or financial information.
Iron Man, which became increasingly popular among cybercriminals during 2026, offered more than 2,300 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, and government agencies worldwide.
These templates allowed scammers to quickly create fraudulent emails, text messages, and websites tailored to specific countries, languages, and organizations without requiring advanced technical skills.
Microsoft said the investigation began in late 2025 after Japanese authorities identified suspicious messaging campaigns targeting people and businesses in Japan. As investigators followed the activity, they discovered a much larger international network supplying cybercriminals with tools and infrastructure.
The investigation eventually expanded to include cybersecurity organizations and technology companies such as Cloudflare, Oracle, Proofpoint, Resecurity, TRM Labs, and the Japan Cybercrime Control Center.
Following an order from the U.S. District Court for the Southern District of Florida, Microsoft and healthcare cybersecurity nonprofit Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Microsoft also disabled more than 20,000 accounts associated with YAM Store and blocked over 100,000 domains used for impersonation and online fraud. The company said it is continuing to remove infrastructure connected to the operation.
