Microsoft and Japan Disrupt Network Behind 1 Billion Scam Messages

Microsoft and Health-ISAC seized and redirected domains supporting three phishing services that enabled more than 1 billion emails and text messages since January 2026, disrupting a network that targeted organizations and people worldwide.

The domain action covered YAM Store, CoGUI and Iron Man and took place under an order from the U.S. District Court for the Southern District of Florida. Microsoft disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.

The campaigns targeted more than 75,000 organizations. They also reached people and organizations in more than 150 countries, including consumers, health care organizations and financial institutions. More than 750 million messages targeted Microsoft customers.

Each service supplied different tools. YAM Store sold fraudulent Microsoft and Google accounts and tools used in scams. CoGUI provided ready-made websites and messages designed to impersonate trusted organizations, while Iron Man offered more than 2,300 templates for impersonating organizations across more than 150 countries.

The investigation began in late 2025 after Japan’s National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. The inquiry uncovered a Chinese-language criminal ecosystem supplying phishing kits and infrastructure. The kits were designed to steal credentials and financial information; an organization’s appearance in a template does not mean its systems were compromised.

“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world,” said Steven Masada, Microsoft’s associate general counsel and Digital Crimes Unit general manager.

Microsoft said the services’ operators generated tens of millions of dollars. Microsoft described ongoing domain blocking and account disabling; the disruption did not establish that every account or piece of infrastructure tied to the network had been removed.