Microsoft and Japan Police Dismantle YAM Store Phishing Supply Chain

Microsoft, working with Japan's National Police Agency, disrupted a marketplace for phishing operations and two associated phishing kits, Microsoft said on October 14, 2026. The action targeted YAM Store, along with kits known as CoGUI and Iron Man. Microsoft

Since January 2026, the three operations collectively enabled more than one billion malicious messages aimed at more than 75,000 organizations worldwide. More than 750 million of those messages were directed at Microsoft customers. The figures describe enabled volume, not necessarily delivered inbox volume, a distinction that matters for defenders tuning detection and response.

The messages reached targets in more than 150 countries. Victimology spanned consumers, healthcare organizations, financial institutions and other businesses. Healthcare involvement drew nonprofit Health-ISAC into the response effort alongside law enforcement. The Verge

YAM Store functioned as a supply point. Scammers could acquire stolen or fraudulent Microsoft and Google accounts there, then use CoGUI and Iron Man to craft and send scam messages. That separation of account supply from message creation and delivery is central to the current phishing economy. Specialization lowers skill barriers for downstream actors.

Account supply depended in part on domain abuse. YAM Store hijacked expired web domains belonging to real organizations and built websites for nonexistent organizations to obtain Microsoft accounts for resale. Expired domains carry residual trust. New registrations under fictitious organization names can pass initial validation checks if provisioning controls rely heavily on web presence.

Iron Man provided scale on the lures themselves. The platform offered more than 2,300 templates for impersonating organizations such as banks and police departments. Template libraries allow rapid localization and rotation. A bank lure can be swapped for a police notice without rebuilding infrastructure.

Microsoft said it disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 web domains used for impersonation and fraud. Microsoft and Health-ISAC also seized and redirected web domains powering YAM Store, CoGUI and Iron Man. Seizure and redirection cut command and distribution points at once. Account disablement and domain blocking address reusable assets.

The investigation began after a wave of fraud and scam activity targeting people and businesses in Japan. Japanese authorities brought the initial scope. Microsoft's inquiry then traced that activity outward to global infrastructure.

Looking at what this means for enterprise defenders, the pattern is familiar. Centralized suppliers absorb operational complexity. Buyers get accounts, templates and sending capability without building them. Takedowns raise costs and force rebuilds. They rarely remove demand. In this author's view, the durable gain here is not only the blocked assets but the visibility into provisioning abuse and template reuse, both of which lend themselves to more persistent detection. The long arc favors defenders when that visibility is retained and shared.