Microsoft and Japan dismantle YAM Store, a cybercrime marketplace behind 1 billion scam messages

Key points

• Microsoft and Japan’s National Police Agency identified YAM Store as a central marketplace selling stolen Microsoft and Google accounts, along with phishing kits CoGUI and Iron Man.
• Since January 2026, these platforms enabled over one billion malicious messages, with 750 million specifically targeting Microsoft customers across 150 countries.
• Microsoft disabled over 20,000 accounts connected to YAM Store and blocked more than 100,000 web domains used for impersonation and fraud.
• The operation involved a civil lawsuit in the U.S. District Court for the Southern District of Florida, with domains seized and redirected in partnership with Health-ISAC.
• Iron Man offered over 2,300 templates for impersonating banks, police, and other organizations, while CoGUI focused heavily on Japanese financial and consumer brands.

Background

This takedown follows a similar Microsoft-led operation in September 2026 against EvilTokens, an AI-driven phishing service that compromised 12,000 accounts. It also aligns with broader international efforts to combat transnational cybercrime, such as the recent crackdown on West African scam networks and the execution of leaders from Myanmar scam rings in China.

How outlets are covering it

The Verge highlights the scale of the operation, noting that YAM Store, CoGUI, and Iron Man generated tens of millions of dollars for their operators. Microsoft’s blog emphasizes the collaborative nature of the investigation, involving partners like Resecurity, Cloudflare, and the Japan Cybercrime Control Center (JC3), and stresses the importance of disrupting the 'service economy' behind scams. Proofpoint focuses on the technical details, identifying CoGUI, CoAceV, and CoFish_Ws as related kits with overlapping infrastructure, and notes that the takedown will likely cause significant operational friction for threat actors. The Hacker News provides additional technical insights, such as the use of cryptocurrency for payments and the specific tradecraft of YAM Store, including the use of Tor infrastructure and automated reconnaissance.

Why it matters

The takedown of YAM Store and its associated phishing kits represents a significant blow to the infrastructure supporting large-scale phishing and credential theft. By disrupting the marketplace and tools that enable these attacks, Microsoft and its partners aim to reduce the volume of scam messages and protect organizations and consumers worldwide. This operation also highlights the growing trend of cybercriminals relying on interconnected services and marketplaces to scale their operations, underscoring the need for international cooperation and private-public partnerships in combating transnational cybercrime.

What to watch

Microsoft and its partners will continue to dismantle the remaining infrastructure of YAM Store and its associated phishing kits. The civil lawsuit in Florida may lead to further legal actions against the operators of these platforms. Additionally, the takedown may prompt other organizations and governments to strengthen their defenses against phishing and credential theft, and to collaborate more closely with private sector companies in combating cybercrime.