Microsoft and Japan's police dismantle scam network behind one billion phishing messages

Microsoft and Japan's National Police Agency have taken apart a cybercrime operation responsible for more than a billion phishing messages, the company announced. According to The Verge, Microsoft's investigation traced the flood of scam texts and emails — the fake parking tickets and bogus package delivery notices familiar to most phone owners — to an underground marketplace called YAM Store and two phishing kits known as CoGUI and Iron Man.

The scale of the operation

Figures from Microsoft's report, cited by The Verge, show how industrialized the scheme had become. Since January 2026, YAM Store, CoGUI and Iron Man collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, and more than 750 million of those messages were aimed at Microsoft customers alone. Recipients included consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries. Microsoft says the operation generated tens of millions of dollars for the people running it.

How the scam pipeline worked

YAM Store functioned as a supply shop for fraudsters. According to The Verge, buyers could purchase stolen or fraudulent Microsoft and Google accounts on the marketplace and then use the phishing kits to push scam messages at scale.

The marketplace also manufactured its own inventory. Microsoft says YAM Store took over web domains belonging to real organizations after their registrations lapsed, and built websites for organizations that did not exist at all. Both techniques were used to obtain Microsoft accounts that could then be resold to other criminals.

The Iron Man kit supplied the disguises. Microsoft says it offered more than 2,300 templates scammers could deploy to impersonate banks, police departments and other trusted institutions, lowering the skill barrier for anyone who wanted to run a convincing campaign.

What Microsoft and its partners did

Microsoft reports that it disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 web domains that were being used for impersonation and fraud. The company also worked with Health-ISAC, a nonprofit focused on healthcare-sector cybersecurity, to seize and redirect the domains that were powering all three platforms, cutting off the infrastructure behind the marketplace and both kits.

Why it matters

A single ecosystem enabling a billion messages against 75,000 organizations is a reminder that phishing is no longer a cottage industry. Marketplaces, ready-made kits and thousands of impersonation templates mean attackers can rent competence instead of building it, which explains both the volume and the reach into sectors like healthcare and finance.

Two of the operation's supply chains also point to defenses organizations actually control. Lapsed domain registrations and compromised or fraudulently obtained accounts were the raw materials here, so renewing expiring domains, monitoring for brand impersonation and locking down accounts remain practical countermeasures.

The takedown also illustrates the enforcement model for this kind of crime: a private company's telemetry and legal tools combined with a national police agency and a sector-specific threat-sharing group. For ordinary users, the immediate effect should be fewer of those scam texts — at least until the operators or their customers regroup on new infrastructure.