Microsoft disables 20,000 accounts tied to Yam Store, a phishing kit marketplace
Microsoft and international partners dismantled the Yam Store phishing marketplace, whose kits enabled more than 1 billion malicious messages. Microsoft says buyers could deploy the pre-made kits very quickly, so a polished lure says little about the sender's skill.
The Product Desk
Key figures: more than 1 billion malicious messages enabled by the YAM Store, CoGUI and Iron Man kits since January 2026; more than 750 million messages sent to Microsoft customers; more than 2,300 templates impersonating organizations across more than 150 countries.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Malicious messages enabled since January 2026 | 1,000,000,000 messages, over | 2 | |
| To Microsoft customers | 750,000,000 messages, over | 3 | |
| Templates impersonating organizations | 2,300 templates, over | across more than 150 countries | 12 |
What happened
- The probe began in late 2025, when Japan's National Police Agency told Microsoft about a wave of fraud and scam activity aimed at people and businesses in Japan.
- Microsoft says it disabled more than 20,000 accounts tied to Yam Store and blocked more than 100,000 web domains used for impersonation and fraud.
- Working with the non-profit Health-ISAC, Microsoft also seized and redirected the web domains that powered all three platforms.
- The newer Iron Man kit came to the fore in mid-2026 with pre-built lure pages that captured whatever data victims submitted.
Why it matters
- exposure A lapsed domain is an exposure the sources show being exploited, so renewal ownership belongs on the security risk list.
- decision An organization named in a template list has to decide what to tell customers, because Microsoft says appearing there is not evidence its systems were compromised.
- precedent Investigators who expected separate campaigns found one marketplace behind them, so lures hitting your staff that look unrelated may share a seller.
In the Iron Man kit, a text about an unpaid toll or a held parcel was a stock item. Investigators found more than 2,300 templates impersonating organizations in more than 150 countries, among them postal and courier services and toll and transportation authorities [12][13]. Steven Masada, associate general counsel and GM for Microsoft's Digital Crimes Unit, said: "Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data." [15]
Buyers browsed, compared prices and bought, and the tools were arranged by age, subscription and environment type, such as .edu or .org [7]. What they bought was fraudulent Microsoft and Google accounts and ready-made tools for credential and data theft [8]. In our view, a lot of awareness training still pictures an attacker who built the page by hand and left rough edges. These kits came with geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations [16].
The supply side starts with organizations that let a domain expire. Operators registered expired domains belonging to legitimate organizations, rebuilt them to look active, and targeted sectors such as non-profits and education to obtain Microsoft 365 accounts they could resell [9].
The Verge dates the count of more than 1 billion messages from January 2026 and ties it to Yam Store, CoGUI and Iron Man together, with more than 75,000 organizations targeted [2]. Microsoft says more than 750 million went to its own customers [3]. On the rounded figures that is about three in four [21]. Computerworld names the three popular kits as Iron Man System, CoGUI and Haozi, and reports Microsoft's estimate that the activity generated "tens of millions of dollars" for the operators [10][4].
The pitch is a dismantled marketplace [1]. The record lists accounts disabled and domains blocked or seized [5][6]. Neither report says anyone was arrested or charged, or whether message volume has fallen since.
Members of Microsoft Threat Intelligence and the Digital Crimes Unit wrote that "the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses." [18]
For Monday, we'd sort every control you own into a 2x2. One axis is who is hit: your staff, or the public receiving a message that impersonates your organization. The other is what stops the attack: a person noticing something is off, or a control that holds when the page is perfect. In our view the kits described here are aimed at the first of those two. We'd move effort first to any cell that rests only on a person's judgement. The cost is rollout work and sign-in friction that a training module does not carry. On the public side, the one control the sources point to directly is a renewal calendar for the domains you own, since operators took lapsed ones [9].
What to watch
- Whether Microsoft or Japan's National Police Agency reports arrests or charges against the people who ran Yam Store.
- Whether CoGUI, Haozi or Iron Man templates reappear on another storefront after the domain seizures.
- Whether Microsoft publishes message volumes after the takedown that show a measurable drop.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption70
- Hype gap+10
- Incentives50
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft says it dismantled Yam Store, a coordinated underground marketplace in commercial phishing-as-a-service, after a nearly year-long investigation with international authorities and several tech and cybersecurity companies.
- [2]
Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide.
- [3]
More than 750 million of the messages were sent to Microsoft customers alone.
- [4]
The activity ultimately generated "tens of millions of dollars" for criminal operators.
- [5]
Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud.
- [6]
With health sector cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected web domains that were powering all three platforms.
- [7]
Yam Store customers could browse, compare prices and make purchases, and available tools were arranged by age, subscription and environment types such as .edu or .org sites.
- [8]
The merchandise was fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams like credential and data theft.
- [9]
Criminal operators registered internet domains that legitimate organizations had allowed to expire, rebuilt them to appear active, and targeted sectors such as non-profits or education to fraudulently obtain Microsoft 365 accounts to sell through the store.
- [10]
Researchers identified three popular phishing-as-a-service kits: Iron Man System, CoGUI and Haozi.
- [11]
The newer Iron Man system came to the fore in mid-2026 and provided pre-built lure pages capturing any victim-submitted data.
- [12]
Through test purchases and intelligence work, investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.
- [13]
The lure sites impersonated organizations including healthcare providers, police departments, government agencies, postal and courier services, toll and transportation authorities, tax agencies, banks, telecoms and retailers.
- [14]
The investigation began in late 2025 after Japan's National Police Agency notified Microsoft of "a wave of fraud and scam activity" targeting people and businesses in Japan.
- [15]
"Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data."
- [16]
The kits were equipped with advanced evasion techniques such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations.
- [17]
Masada emphasized that an organization or government entity presented among the template offerings does not indicate that its systems were compromised.
- [18]
"the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses."
- [19]
The network allowed cybercriminals to readily purchase, and very quickly deploy, pre-made kits for phishing attacks to steal data and credentials.
- [20]
Researchers expected to find multiple individual campaigns but instead discovered a "sprawling Chinese-language cybercrime marketplace."
- [21]
The 750 million-plus messages to Microsoft customers are about three-quarters of the 1 billion-plus total, on the rounded figures (both are floors).
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Cybercrime takedownsFollow
- Phishing defenseFollow
- Phishing-as-a-service kitsFollow