Microsoft and Japan Dismantle Cybercrime Network Behind Over One Billion Scam Messages

We have all received a fake parking ticket or package delivery scam text, but hopefully you've seen fewer of them. Microsoft says it has helped eliminate the marketplace for scammers who, like them, send phishing messages worldwide. Working with Japan's National Police Agency, it disrupted the scam operation to […]

Posts in this thread will be added to your daily email summary and home page feed.

Microsoft says it has disabled more than 20,000 accounts linked to a marketplace for fraudsters.

Posts from this author will be added to your daily email digest and home page feed.

is a news writer covering all things consumer technology. Stevie started writing news and reviews about hardware, gaming and artificial intelligence at Laptop Mag.

We've all received a scam text about an existing parking ticket or fake package delivery, but hopefully you'll see fewer of them. Microsoft says it has helped eliminate a market for scammers like them who send phishing messages around the world. Through an investigation with Japan's National Police Agency, it traced the fraudulent activity to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man:

As of January 2026, YAM Store, CoGUI, and Iron Man have collectively enabled more than one billion malicious messages targeting more than 75,000 organizations worldwide, including more than 750 million messages to Microsoft customers alone. These messages have been used to target consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.

According to Microsoft's report, fraudsters can use stolen or fraudulent Microsoft and Google accounts in the YAM store and use phishing kits to send fraudulent messages. Microsoft says the YAM Store also hijacked expired web domains of real organizations and created websites for existing organizations that it used to obtain Microsoft accounts that it could resell.

The Iron Man platform also offered more than 2,300 templates that fraudsters could use to impersonate organizations such as banks and police departments. Microsoft says it has disabled more than 20,000 accounts connected to the YAM Store and blocked more than 100,000 web domains used for impersonation and fraud. With the nonprofit cybersecurity arm Health-ISAC, Microsoft also confiscated and redirected the web domains that powered all three platforms.

I tried Apple's HomeView smart display

The Tesla Roadster could have remained vaporized

Everything Apple released at its "Welcome Home" event

A free daily digest of the news that matters most.

By providing your information, you agree to our Terms of Use and Privacy Policy. We use vendors who may also process your information to help provide our services. This site is protected by reCAPTCHA and Google's Privacy Policy and Terms of Service apply.