Key points
- Microsoft disabled over 20,000 accounts linked to the YAM Store marketplace.
- The network used CoGUI and Iron Man kits to send more than one billion messages.
- Over 75,000 organisations were targeted, with tens of millions of dollars generated.
The YAM Store operation provided attackers with ready-made phishing kits and fraudulent accounts, enabling them to launch large-scale credential theft campaigns against global businesses. By purchasing these tools, criminals could quickly impersonate trusted brands to steal data from users.
In plain English
This was not a single hacker, but a commercial service selling the components for mass phishing. Attackers bought fake Microsoft and Google accounts and pre-written scam templates to trick victims into handing over login details. The marketplace handled the infrastructure, letting buyers focus solely on sending the deceptive messages.
The background
According to Microsoft, the probe started in late 2025 after Japan’s National Police Agency flagged a surge in fraud. Investigators, aided by AI tools, traced the activity to a Chinese-language marketplace. From January 2026, the platform facilitated over one billion messages, with 750 million targeting Microsoft customers across more than 150 countries.
What changes now
Microsoft has disabled over 20,000 associated accounts and blocked more than 100,000 domains used for impersonation. Working with partners like Cloudflare and Proofpoint, the company also seized domains powering the YAM Store, CoGUI, and Iron Man platforms, disrupting the supply chain for these commercial phishing operations.
The attacker's path
Teams usually assess how attackers use initial access brokers to bypass identity checks. These marketplaces lower the technical barrier, allowing criminals to purchase compromised credentials rather than stealing them directly. Organisations should check whether their domain expiry notifications are functioning correctly. Verify that abandoned domains cannot be used to send email from your brand, as this undermines trust.
Background: Phishing
Spam is bulk, unsolicited messaging with no immediate malicious intent, while phishing is a deceptive tactic designed to trick you into revealing sensitive information. You distinguish phishing vs spam by checking for urgency, personalised requests, and suspicious links. Treat all unsolicited messages as potential threats until verified through separate channels.
Read the full guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
What to do and how to stay safe: Microsoft
- Audit expired domain portfolios to ensure legitimate sites are renewed promptly.
- Enable multi-factor authentication on all business email accounts to reduce credential theft risk.
- Train staff to recognise impersonation attempts, especially those using familiar branding or urgent language.
- Monitor for unexpected spikes in login failures or unusual account activity from known users.
Step-by-step guide: Incident Response Plans: Best Practices for Resilient Recovery
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What was YAM Store?
It was a cybercrime marketplace that sold stolen accounts and phishing kits like CoGUI and Iron Man, enabling mass scam campaigns.
How many messages were sent?
The network enabled the sending of over one billion malicious messages to more than 75,000 organisations worldwide since January 2026.
Did Microsoft stop the operation?
Microsoft disabled over 20,000 accounts and blocked more than 100,000 domains in collaboration with Japanese authorities and other partners.
