Glonce

Microsoft helps take down YAM Store scam marketplace behind a billion messages

securityThe Glonce editorsVerge🔥52Glonce rating52Impact50Novelty45Relevance60Surprise35Players60Credibility85
Microsoft helps take down YAM Store scam marketplace behind a billion messages

Microsoft says it helped dismantle a marketplace for scammers that supplied the tools behind phishing messages sent around the world, the sort of fake parking-ticket and package-delivery texts many people have received. Through an investigation with Japan's National Police Agency, Microsoft tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man.

The scale, as Microsoft describes it: since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of those messages were geared toward Microsoft customers alone. The messages were used to target consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, and generated tens of millions of dollars for the operators.

How the scheme worked, according to Microsoft's report: scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and then use the phishing kits to send scam messages. Microsoft says YAM Store also hijacked the expired web domains of real organizations and created websites for nonexistent organizations, and used these to obtain Microsoft accounts that it could resell. The Iron Man platform, for its part, offered over 2,300 templates that scammers could use to impersonate organizations such as banks and police departments.

What Microsoft did: it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud. Together with Health-ISAC, a health sector cybersecurity non-profit, Microsoft also seized and redirected the web domains that were powering all three platforms.

Key facts

  • Microsoft says it helped dismantle the YAM Store scam marketplace and the CoGUI and Iron Man phishing kits, working with Japan's National Police Agency.
  • Since January 2026 the three services collectively enabled more than one billion malicious messages aimed at over 75,000 organizations in more than 150 countries, including more than 750 million aimed at Microsoft customers.
  • YAM Store sold stolen or fraudulent Microsoft and Google accounts; Iron Man offered over 2,300 templates for impersonating organizations such as banks and police departments.
  • Microsoft disabled over 20,000 accounts tied to YAM Store and blocked over 100,000 domains; with Health-ISAC it seized and redirected domains powering all three platforms.
  • The operators earned tens of millions of dollars, according to Microsoft.

Why it matters

The takedown goes after the supply side of phishing rather than individual messages. YAM Store sold the accounts, and CoGUI and Iron Man supplied the kits and impersonation templates, so one disruption touches the toolchain behind a very large volume of scams. Microsoft puts that volume at more than a billion malicious messages since January 2026, with the money flowing to operators in the tens of millions of dollars. It is also a joint effort: a private company, Japan's National Police Agency and a health sector non-profit, Health-ISAC.

Who it affects

Microsoft names consumers, healthcare organizations, financial institutions and other businesses as the targets, across more than 150 countries and over 75,000 organizations. Microsoft customers were the focus of more than 750 million of the messages. Banks and police departments appear in the story as the organizations impersonated through the Iron Man templates, and holders of Microsoft and Google accounts as the accounts being sold.

How to use it

This is an enforcement action, not a product or tool, so there is nothing to adopt. The practical effect described is disruption: over 20,000 YAM Store accounts disabled, over 100,000 impersonation and fraud domains blocked, and the domains behind all three platforms seized and redirected. The article's hope is that people will see fewer scam texts of the fake parking ticket and fake package delivery kind.

How solid is it

The account is Microsoft's own, relayed by The Verge from Microsoft's report. The figures (a billion-plus messages, 75,000 organizations, 150 countries, 20,000 accounts, 100,000 domains, 2,300 templates) are Microsoft's, and the money figure is given only as 'tens of millions of dollars'. The involvement of Japan's National Police Agency and Health-ISAC is stated in the same account.

Risks and caveats

The source mentions no arrests, charges or named suspects, and it does not say who operated YAM Store, CoGUI or Iron Man or where they were based. No date is given for the takedown itself. It does not say whether the services are fully offline or could return, and it gives no timescale or numbers for how much scam messaging is expected to fall. The message counts cover January 2026 onward and are Microsoft's estimates as reported.