Key points
- Microsoft disabled over 20,000 accounts connected to the YAM Store marketplace.
- The network facilitated more than one billion malicious messages since January 2026.
- Over 750 million of those messages targeted Microsoft customers specifically.
Microsoft has disabled thousands of accounts linked to YAM Store, a cybercrime marketplace responsible for distributing phishing kits. This action follows a joint investigation with Japan’s National Police Agency that identified the network as a source of over one billion scam messages.
What happened
Microsoft states that it disabled more than 20,000 accounts connected to YAM Store, according to The Verge. The marketplace operated alongside two phishing kits, CoGUI and Iron Man, to distribute malicious content globally.
The network sent more than one billion messages to over 75,000 organisations since January 2026, according to CSO Online. More than 750 million of these messages were directed at Microsoft customers alone.
Operators used YAM Store to purchase fraudulent Microsoft and Google accounts, according to Computerworld. They also hijacked expired domains from legitimate organisations to create fake sites for reselling access.
Microsoft blocked over 100,000 web domains used for impersonation and fraud, according to The Verge. The Iron Man platform provided more than 2,300 templates for impersonating banks and police departments.
Why it matters
The scale of the operation suggests industrialised phishing-as-a-service models are becoming more accessible to criminals. Tens of millions of dollars were generated for operators targeting sectors including healthcare and finance, according to CSO Online.
Microsoft’s Digital Crimes Unit used AI tools to connect seemingly unrelated accounts and infrastructure, according to Computerworld. This helped expose the broader criminal marketplace behind simple scam messages.
What happens next
- Review inbound messages from unfamiliar domains for signs of impersonation.
- Verify account security settings for any services linked to expired domains.
- Monitor for new phishing templates mimicking trusted organisations.
- Coordinate with internal legal teams regarding potential exposure to scam traffic.
Patch priority
Teams should prioritise reviewing domain portfolios for expired assets that could be repurposed by attackers. Ensure that domain renewals are automated to prevent lapses that criminals might exploit for impersonation. Audit third-party account integrations to confirm they are not sourcing credentials from unverified marketplaces. Implement strict verification protocols for new account requests to reduce the risk of fraudulent enrolment. Validate that email filtering rules are updated to catch messages from recently registered or suspicious domains.
What to do and how to stay safe: Microsoft
- Inspect email headers for discrepancies between sender display names and actual domain origins.
- Verify the legitimacy of incoming requests for sensitive information by contacting the purported sender through a separate, trusted channel.
- Ensure that multi-factor authentication is enabled on all user accounts to mitigate the impact of stolen credentials.
- Monitor organisational brand mentions online for unauthorized use or impersonation attempts.
Step-by-step guide: Seven Social Engineering Mistakes That Leave Your Defences Open
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many messages did the YAM Store network send?
The network enabled more than one billion malicious messages targeting over 75,000 organisations worldwide.
Which organisations were targeted by this phishing network?
The network targeted consumers, healthcare organisations, financial institutions, and other businesses in more than 150 countries.
What tools were used to send these scam messages?
Scammers used the YAM Store marketplace along with CoGUI and Iron Man phishing kits to distribute the messages.
