Microsoft says it disabled over 20,000 accounts connected to a marketplace for scammers.
Microsoft says it disabled over 20,000 accounts connected to a marketplace for scammers.
We’ve all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you’ll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan’s National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man:
Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone. These messages have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.
According to Microsoft’s report, scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages. Microsoft says YAM Store also hijacked real organizations’ expired web domains and created websites for nonexistent organizations, which it used to get Microsoft accounts it could resell.
The Iron Man platform was also offering over 2,300 templates scammers could use to impersonate organizations like banks and police departments. Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud. With health sector cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected web domains that were powering all three platforms.
