Microsoft, Japan Police Disrupt Scam Marketplace YAM Store
Microsoft says it disabled over 20,000 accounts tied to YAM Store and blocked more than 100,000 domains used for phishing and fraud.
Microsoft said it helped dismantle a cybercrime marketplace called YAM Store and two phishing kits, CoGUI and Iron Man, disabling more than 20,000 accounts and blocking over 100,000 web domains used for impersonation and fraud, according to theverge.com.
The company worked with Japan's National Police Agency to trace scam activity to the marketplace and the two kits. Microsoft also partnered with Health-ISAC, a health sector cybersecurity non-profit, to seize and redirect web domains that powered all three platforms.
Microsoft's report states that scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages. The Iron Man platform offered over 2,300 templates for impersonating organizations such as banks and police departments, the report says.
Scale of the operation
Since January 2026, YAM Store, CoGUI and Iron Man collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages aimed at Microsoft customers alone, according to Microsoft.
Those messages were used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for the operators, Microsoft said. The company added that YAM Store also hijacked expired web domains belonging to real organizations and created websites for nonexistent ones, which it used to obtain Microsoft accounts it could resell.
Quick answers
What is YAM Store?
YAM Store was a marketplace where scammers could buy stolen or fraudulent Microsoft and Google accounts and use phishing kits to send scam messages, according to Microsoft.
How many accounts and domains did Microsoft disable or block?
Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains used for impersonation and fraud.
Who partnered with Microsoft on the takedown?
Microsoft worked with Japan's National Police Agency and Health-ISAC to seize and redirect domains that powered YAM Store, CoGUI, and Iron Man.