Microsoft Helped Shut Down a Huge Online Scam Shop
Microsoft, working with Japan's National Police Agency, shut down an online shop for scams and two scam kits, Microsoft said on October 14, 2026. The targets were YAM Store, plus kits called CoGUI and Iron Man. Microsoft
Since January 2026, the three together made possible more than one billion scam messages aimed at more than 75,000 organizations. More than 750 million were aimed at Microsoft customers. That is the amount the systems could send, not the amount that reached inboxes. The difference matters for people who build filters.
The messages reached targets in more than 150 countries. Victims included ordinary people, healthcare groups, banks and other businesses. Because healthcare was hit, the nonprofit Health-ISAC joined the response with law enforcement. The Verge
YAM Store worked like a supply store. Scammers bought stolen or fake Microsoft and Google accounts there, then used CoGUI and Iron Man to write and send fake messages. To get accounts to resell, YAM Store took over old web addresses from real groups, which still held trust, and made websites for fake groups. New fake groups could pass checks when those checks leaned on having a website.
Iron Man supplied the fake messages at scale, with more than 2,300 ready-made forms for pretending to be groups such as banks and police. A scammer could swap one form for another without starting over.
Microsoft said it shut down more than 20,000 accounts tied to YAM Store and blocked more than 100,000 web addresses used for scams. Microsoft and Health-ISAC also seized and rerouted the addresses that ran YAM Store, CoGUI and Iron Man. The case started with a wave of fraud aimed at people and businesses in Japan. Japanese authorities set the early scope, and Microsoft traced it to global systems.
Stepping back, the pattern is a known one. Central sellers do the hard work, so buyers do not need much skill. Shutdowns raise costs and force rebuilds, though they seldom end demand. In my view the lasting gain is what was learned about fake accounts and reused message forms, which can improve defenses. Keeping and sharing that knowledge leaves people better protected over time.
