Microsoft and Japan Police neutralize billion-message scam ring

Microsoft and Japan’s National Police Agency dismantled a transnational cybercrime service network behind more than one billion phishing messages sent worldwide since January 2026. The infrastructure relied on a Chinese-language marketplace named YAM Store alongside two phishing kits called CoGUI and Iron Man.

The operation targeted consumers, financial institutions, and healthcare organizations across more than 150 countries. According to blogs.microsoft.com, the campaign generated tens of millions of dollars for its operators while targeting over 75,000 organizations worldwide, with more than 750 million messages directed at Microsoft customers specifically.

The Tech TL;DR:

• Microsoft and Japan’s National Police Agency disrupted YAM Store, CoGUI, and Iron Man, a cybercrime ecosystem responsible for over a billion malicious messages since January 2026.
• The marketplace sold ready-made phishing kits and compromised accounts that impersonated trusted entities like Amazon, Microsoft, and Google to steal credentials and payment data.
• Global infrastructure providers and threat intelligence firms, including Cloudflare, Oracle, Proofpoint, TRM Labs, and the Japan Cybercrime Control Center, assisted in mapping and dismantling the operation.

Tracing the Transnational Infrastructure Behind YAM Store

The investigation began in late 2025 after Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns directed at individuals in Japan. Investigators discovered a sprawling Chinese-language cybercrime marketplace that supplied criminals with ready-made web pages, messaging templates, and infrastructure. Rather than writing custom exploit code, operators purchased pre-packaged tools to impersonate banks, government bodies, and retail brands.

The marketplace operated similarly to an e-commerce platform. Customers browsed inventory, compared pricing, and bought fraudulent Microsoft and Google accounts alongside specialized phishing kits. Controlled purchases conducted by Microsoft confirmed how the marketplace functioned, revealing that operators acquired internet domains originally allowed to expire by legitimate educational and non-profit organizations to host credential-harvesting pages.

Global Threat Intelligence and Coalition Response

As the investigation expanded, the Japan Cybercrime Control Center connected isolated domestic incidents to a broader pattern of financial fraud and identity theft. Additional telemetry and threat intelligence were provided by Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, allowing investigators to track the business entities sustaining the criminal operations.

Health-ISAC joined Microsoft to coordinate the takedown of YAM Store, CoGUI, and Iron Man, focusing on operational resilience across the health sector. The targeted kits automated the deployment of credential-stealing infrastructure at scale, lowering the technical barrier of entry for low-level threat actors globally.

# Example of a typical phishing redirect header analysis pattern
curl -I https://suspected-expired-domain.edu/login
HTTP/2 301 Moved Permanently
Location: https://malicious-credential-harvesting-node.xyz/auth/verify
X-Frame-Options: SAMEORIGIN

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.

More on Police: MACC and Police Probe MyEG and Zetrix AI Over RM314 Million Unremitted Revenue