THE CRUNCH
Microsoft says it has helped dismantle a cybercrime operation behind more than a billion scam texts and phishing messages worldwide. Working with Japan's National Police Agency, the company traced the activity to YAM Store, a marketplace where scammers could buy stolen or fraudulent Microsoft and Google accounts, along with two phishing kits called CoGUI and Iron Man. Since January 2026, the three platforms have collectively enabled over one billion malicious messages targeting more than 75,000 organisations across more than 150 countries, including consumers, healthcare organisations and financial institutions, and generating tens of millions of dollars for their operators.
More than 750 million of those messages were aimed at Microsoft customers alone. The Iron Man platform offered over 2,300 templates for impersonating organisations such as banks and police departments, the kind of setup behind familiar scams about fake parking tickets or parcel deliveries.
Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains used for impersonation and fraud. The marketplace also hijacked organisations' expired web domains and built sites for nonexistent organisations to obtain Microsoft accounts it could resell. Alongside health sector cybersecurity non-profit Health-ISAC, Microsoft seized and redirected web domains powering all three platforms.