Microsoft takes down a phishing marketplace behind 1 billion scam messages

They did. Microsoft says the investigation led to "a sprawling Chinese-language cybercrime marketplace" where criminals could buy what they needed to run scams.

The center of it was YAM Store. Microsoft says it worked much like a normal online shop. Customers could browse products, compare prices and buy fraudulently obtained Microsoft and Google accounts, plus other ready-made tools for stealing passwords. Microsoft made controlled purchases to confirm how it worked.

Think of it like a hardware store for scammers. The criminal doesn't make the hammer, the nails or the paint. They walk in, fill a cart and get to work.

BleepingComputer reports that Microsoft tracks YAM Store under the name Storm-3119, and the phishing kits linked to it, CoGUI, Haozi and Iron Man, as Storm-2990.

Each one played a different role in the scam supply chain:

• YAM Store: accounts, licenses, cloud storage and hosting. In hijacked Microsoft environments, BleepingComputer reports, operators used stolen app credentials and abused SharePoint and OneDrive to host their pages.
• CoGUI: ready-made fake websites and messages impersonating companies, banks, government agencies and other trusted names. Instead of building a fake site, a criminal could just deploy one.
• Iron Man: a newer kit that replaced CoGUI by mid-2026. Microsoft says it offered more than 2,300 templates impersonating banks, retailers, healthcare providers, transport authorities, police departments and government agencies in over 150 countries.

Some templates were built for government impersonation, using the look of official authority to pressure people into paying. Others copied airlines, phone companies, retailers and parcel delivery services.

The catch: Microsoft stresses that an organization showing up in these templates does not mean its systems were hacked. The scammers copied the look, not the keys.

Very. Here's what Microsoft reported:

• Messages: more than 1 billion malicious messages since January 2026.
• Targets: over 75,000 organizations in more than 150 countries.
• Microsoft customers: more than 750 million of those messages.
• Profit: tens of millions of dollars for the operators.

Victims included consumers, healthcare organizations, financial institutions and other businesses. BleepingComputer adds that many of the messages aimed at Microsoft 365 users used device-code phishing, a trick that gets someone to approve a sign-in code so the attacker receives a login token.

Researchers at Resecurity, which helped the investigation, found an exposed system behind Iron Man with 911 published builds, BleepingComputer reports. They also found a catalog of 2,360 phishing packages covering 130 countries and areas, updated as recently as October 1, 2026.

The kits came with built-in hiding tricks. BleepingComputer reports they supported geofencing, fake CAPTCHA gates and IP filtering.

• Geofencing: the fake page only shows up for visitors from the targeted country.
• Fake CAPTCHA gates: a "prove you're human" box that keeps automated security scanners out.
• IP filtering: known addresses of security companies get a harmless page instead.

So when a researcher checked a link, it could look clean, while the person it was meant for saw the trap.

SecurityWeek quotes Microsoft's threat intelligence team describing YAM Store as an "access broker," a middleman that hijacks Microsoft 365 and Azure for Education tenants. It also reports that Iron Man was advertised on YAM Store in June 2026.

Parts of it had been on researchers' radar for a while. BleepingComputer reports that in late 2024, the security company Proofpoint spotted email campaigns tied to the CoGUI kit that were "consistently targeting Japan."

Those campaigns impersonated well-known Japanese companies and international organizations to steal logins and payment details. Further digging found more than 17,000 domains used by three related kits, CoGUI, CoAceV and CoFish_Ws. Researchers called the operation resourceful enough "to purchase and manage phishing infrastructure at scale."

It started small. In late 2025, Japan's National Police Agency alerted Microsoft to scam messages targeting people in Japan.

The partners expected to find individual campaigns. Instead, Microsoft says, they found the businesses supplying criminals around the world. The ecosystem was in Chinese, which made it hard for investigators who weren't native speakers to get inside.

Here's who helped, according to Microsoft:

• Japan's National Police Agency: intelligence and investigative support throughout.
• JC3 (Japan Cybercrime Control Center): connected separate incidents across its 130-plus member organizations.
• Health-ISAC: insight into the impact on healthcare organizations.
• Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs: intelligence and investigative support.

Microsoft says AI tools helped connect accounts, websites and infrastructure that first looked unrelated. It also shared intelligence with the US Secret Service and international law enforcement.

One trick stood out. Microsoft says YAM Store's operators bought internet domains that real organizations had let expire, often nonprofits and schools.

Then they rebuilt the old websites so the organizations looked active again. With that fake front, they could get Microsoft 365 accounts and resell them through the store.

BleepingComputer reports a second method: using AI tools to invent fake organizations from scratch, complete with content and documentation.

In real life If your club, school or small charity ever lets its website address lapse, someone else can buy it. Keep renewing domains you've used for email, even after you stop using them.

By the numbers: with an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that powered YAM Store, CoGUI and Iron Man.

Microsoft has also:

• Disabled more than 20,000 accounts connected to YAM Store.
• Blocked more than 100,000 domains used for impersonation and fraud.
• Kept removing infrastructure hosted on its own services.

What's next: Microsoft says these three services are only part of a larger criminal network, so the scam texts won't stop overnight. But disrupting the suppliers makes it harder for criminals to get the accounts and tools they rely on.

TechRadar notes that the announcement doesn't mention arrests. It points to earlier cases, like the 2025 takedown of the Cracked and Nulled forums, where arrests came alongside server seizures.

Because there are far fewer suppliers. Microsoft's argument is that the scam message is often the only part a victim ever sees, while the businesses behind it are what make it possible.

It fits a trend Microsoft describes in this year's Digital Defense Report: modern fraud relies more and more on services that help criminals reach more victims with less effort. Taking out a supplier hits thousands of small operations at once.

• Same scams, fewer tools: texts about tolls, fines, deliveries and account problems will keep coming, but this removes a big source of them.
• Never tap the link: open the company's official app or type its address yourself.
• Watch for sign-in codes: if a message asks you to enter or approve a code you didn't request, stop. That's how device-code phishing works.
• Real logos prove nothing: these kits copied thousands of real brands, so a familiar logo doesn't make a message safe.