Microsoft and Japan Police Disrupt Huge Phishing Supply Network

Microsoft, working with Japan's National Police Agency, disrupted a marketplace for phishing operations and two associated phishing kits, Microsoft said on October 14, 2026. The targets were YAM Store, along with kits known as CoGUI and Iron Man. Microsoft

Since January 2026, the three operations together enabled more than one billion malicious messages aimed at more than 75,000 organizations worldwide. More than 750 million of those messages were aimed at Microsoft customers. That figure is enabled volume, or what the infrastructure made possible, not the number that reached inboxes, a distinction defenders use when tuning detection and response.

The messages reached targets in more than 150 countries. Those affected included consumers, healthcare organizations, financial institutions and other businesses. Because healthcare was affected, the nonprofit Health-ISAC joined the response alongside law enforcement. The Verge

YAM Store worked as a supply point, much like a parts store for crime. Scammers could buy stolen or fraudulently created Microsoft and Google accounts there, then use CoGUI and Iron Man, ready-made kits for crafting and sending scam messages, to run their campaigns. That split between account supply and message delivery lowers the skill needed by later buyers.

To stock accounts, YAM Store abused domains. It hijacked expired web domains from real organizations, which still carried trust, and built websites for nonexistent organizations to obtain Microsoft accounts for resale. Fake groups could pass early checks when provisioning controls relied heavily on web presence.

Iron Man provided scale for the lures, offering more than 2,300 templates for impersonating organizations such as banks and police departments. That library allowed quick localization and rotation, so a bank lure could become a police notice without rebuilding infrastructure.

Microsoft said it disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 web domains used for impersonation and fraud. Microsoft and Health-ISAC also seized and redirected the domains running YAM Store, CoGUI and Iron Man. The case began with a wave of fraud aimed at people and businesses in Japan. Japanese authorities set the early scope, and Microsoft traced that activity to wider global infrastructure.

The broader context here will be familiar to longtime watchers of cybercrime. Central suppliers absorb the hard work, so buyers get accounts, templates and sending tools without building them. Takedowns raise costs and force rebuilds, though they seldom remove demand. In my view the lasting gain is visibility into provisioning abuse and template reuse, which supports more durable detection. Shared and kept, that knowledge leaves defenders better placed over time.