Microsoft and Japan’s National Police Agency teamed up for a global phishing network takedown to dismantle an online illicit market called YAM Store and several linked phishing kits [1]. The criminal network sent more than one billion fake email and SMS messages targeting over 75,000 organizations in more than 150 nations since January 2026 [2]. Police deactivated thousands of fraudulent accounts. They seized server nodes that drove web crime schemes around the globe [1].
Coordinating the Phishing Network Takedown
The joint inquiry began when Microsoft partnered with Japan’s National Police Agency to track a wave of fraud aimed at cloud accounts, leading investigators to uncover a covert server hub tracked as Storm-3119 [1]. Police and security firms discovered that scammers used this central hub to buy hijacked computer setups and launch coded phishing runs against global targets [2]. The network made tens of millions.
Unlike campaigns that compromise individual endpoints, such as the WaterPlum malware operation compromising global devices, this operation struck the underlying service economy that sold cloud logins directly to scam actors. The joint task force brought together private tech companies and law enforcement agencies, including the JC3 group in Japan, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs [2]. Microsoft shut down over 20,000 buyer accounts tied to the storefront, while teams blocked 100,000 malicious web domains set up for identity fraud. The joint action stopped a criminal pipeline that hit businesses, consumers, healthcare groups, and banks in more than 150 nations, cutting off illicit cash flows that had funded criminal groups worldwide [1].
Legal action in the United States gave the takedown formal teeth. Under an order from the U.S. District Court for the Southern District of Florida, Microsoft teamed up with the Health-ISAC cybersecurity group to seize and redirect domains powering the illicit platforms [2]. It’s a method that cuts off scammers from their command servers before they can register fresh backups [1]. Scammers lost their main web links.
How YAM Store Sold Cloud Environments
At the center of the dark web trade sat YAM Store, an illicit market that sold stolen or fake Microsoft and Google accounts to online thieves [1]. The sellers didn’t just sell simple login passwords; they sold entire preconfigured cloud tenants with valid software licenses and storage space so fraudsters could send massive waves of spam directly through trusted email services without setting off standard spam filters [2].
To stock its shop, YAM Store used several methods to acquire legitimate-looking accounts, including tracking down expired web domains that once belonged to real organizations and rebuilding defunct websites to make those dead entities look active again. In other instances, crews used artificial intelligence tools to invent fake companies from scratch, generating realistic documentation and web content to pass registration checks [2]. These fabricated identities let fraudsters obtain genuine cloud tenants and resell them on the open black market to scammers who wanted ready-to-use mail servers to blast millions of bogus messages before security systems caught on [1].
Once inside compromised Microsoft setups, thieves used stolen app logins to manage user accounts and assign extra software licenses. Scammers also abused SharePoint and OneDrive storage to host phishing lures and malicious files. Because the files sat on genuine company domains, email scanners didn’t flag the links as dangerous, so attackers weren’t forced to set up external file hosting [2]. Theft happened quietly.
Technical Mechanics Behind the Phishing Marketplace Disruption
The crime ring didn’t rely on stolen accounts alone; it packaged those cloud setups with coded phishing tools. Investigators linked YAM Store to three phishing kits known as CoGUI, Haozi, and the Iron Man System, collectively tracked as Storm-2990. These software tools offered scammers an end-to-end setup that handled victim redirection, device fingerprinting, and account theft in real time [2]. Toolkits bundled everything.
Cybersecurity firm Resecurity joined the inquiry and analyzed exposed server networks belonging to the Iron Man platform. Researchers discovered a publicly exposed Git and container registry containing 911 published builds and eight registered administrator accounts. The platform included a product-selection subsystem linked directly to payment-card theft, with researchers cataloging 2,360 phishing packages covering 130 countries or areas with updates running through October 1, 2026. That modular design let scammers pick a target nation and launch a scam wave within minutes, providing localized templates that helped scammers impersonate regional banks and postal services while giving attackers easy access to ready-made code updates [2].
To keep security teams from inspecting fake pages, the kits used geofencing, fake CAPTCHA gates, and IP address filtering. If a security scanner visited a phishing link from outside the target area, the kit showed an error or redirected the bot to a harmless site. The kits also used device-code phishing against Microsoft 365 users to steal authentication tokens directly, a trick that bypassed multi-factor login checks so attackers didn’t need the victim’s raw password [2]. Attackers wanted quick token access.
Targeting Global Users with Fraudulent Lures
The phishing kits generated fake messages that mimicked routine daily notices to trick ordinary people [1]. Common lures warned recipients about unpaid highway tolls, traffic penalties, nonexistent parking tickets, or urgent package delivery problems. Others sent fake security alerts asking employees to verify their email accounts or banking credentials [2]. Many victims clicked.
More than 750 million scam messages targeted Microsoft 365 customers through email and SMS texts, according to figures released by Microsoft. Enterprise security company Proofpoint found that campaigns using CoGUI had been “consistently targeting Japan” since late 2024 to steal logins and banking data by impersonating well-known Japanese corporations and international groups. Further analysis revealed that over 17,000 domains were tied to three kit variants called CoGUI, CoAceV, and CoFish_Ws, showing that the crews were capable enough “to purchase and manage phishing infrastructure at scale”. These scripted delivery setups allowed scam rings to flood consumer phones with SMS texts while keeping domain registration costs low [2]. Proofpoint tracked the threat early.
Over time, the market shifted as newer tools replaced older code [2]. While CoGUI initially focused on targets in Japan and the United States, the newer Iron Man platform pushed it aside by mid-2026, offering over 2,300 prebuilt templates that spoofed banks, retail stores, parcel carriers, and police departments across dozens of languages [1]. That broad catalog made it the top choice for fraud crews who wanted ready-made templates for global scams [2]. Mid-2026 brought a tool shift.
Seizing Domains in the Global Cybercrime Marketplace Takedown
Dismantling this crime web needed joint legal and technical action across borders [1]. Under the civil court order from the Southern District of Florida, Microsoft and Health-ISAC seized and redirected web domains that kept YAM Store, CoGUI, and Iron Man running. Court-authorized network disruptions mirror prior law enforcement actions like the NightmareStresser domain seizure operation, where judicial orders allowed investigators to shut down hostile hosting nodes [2]. Enforcement took legal muscle.
Alongside domain seizures, engineers neutralized rogue tools directly inside cloud platforms. Microsoft shut down over 20,000 rogue profiles linked to the YAM Store storefront and filtered out 100,000 scam addresses used to deceive consumers [1]. Security teams also revoked stolen app logins to stop rogue bots from generating new tenants, cutting off the criminal supply chain that fed scam messages to millions of phones and inboxes [2].
Work continues as police track down remaining server nodes and backup platforms. Japanese police authorities, the JC3 consortium, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs are still dismantling leftover pieces of the Storm-2990 and Storm-3119 networks [2]. The joint action shows that targeting illicit markets weakens the entire phishing ecosystem, even if individual scammers try to regroup under fresh names later on [1]. It’s a major enforcement victory.
- ONLINE NEWS Bonifield, S. (2026, October 14). Microsoft and Japan took down a cybercrime network behind over a billion scam messages. The Verge. [Article Link]
- ONLINE NEWS Toulas, B. (2026, October 14). Global takedown hits network behind 1 billion phishing messages. BleepingComputer. [Article Link]
