Microsoft says it helped Japanese police dismantle phishing marketplace behind 1B+ scam messages

Microsoft said it worked with Japanese authorities to dismantle an online phishing marketplace that it says enabled the sending of more than one billion malicious messages globally.

The company named platforms called YAM Store, CoGUI and Iron Man and said the three collectively enabled the campaign, which it described as targeting over 75,000 organizations including consumers, healthcare providers and financial institutions.

According to Microsoft’s account, more than 750 million of the messages were directed at Microsoft customers and the operation generated "tens of millions of dollars" for the criminal operators. Microsoft said it disabled over 20,000 accounts linked to the marketplace and blocked more than 100,000 web domains used for impersonation and fraud.

Microsoft said the disruption followed an investigation that began after Japan’s National Police Agency notified the company of a wave of fraud and scam activity; csoonline.com reported that the NPA alerted Microsoft in late 2025.

Microsoft described Iron Man as offering many templates for impersonating legitimate organizations, and The Verge said Iron Man was offering more than 2,300 such templates enabling fraud against banks and police departments.

The company and the reporting attribute the operation’s scale to kits and tools sold through the marketplace; csoonline.com said YAM Store sold kits that helped criminals impersonate organizations and steal credentials.

Microsoft said it disabled accounts and domains to disrupt that infrastructure, and the published accounts credit AI-assisted analysis with helping to identify parts of the operation’s infrastructure, according to csoonline.com.

Microsoft framed the effort as a disruption of criminal infrastructure rather than a law-enforcement-only action; the company described technical takedowns and account suspensions as the measures it took. Japanese law enforcement involvement is presented in the sources as the spark for the investigation and as a cooperating actor in dismantling the marketplace.

The outlets report specific numbers and platform names provided by Microsoft and by the reporting: over one billion messages total, more than 750 million aimed at Microsoft customers, over 20,000 accounts disabled and over 100,000 domains blocked.

Those figures come from Microsoft’s statements and the pieces that cited them; no independent verification beyond the company’s disclosures is provided in the available reporting.

The reporting indicates the operation affected organizations across more than 150 countries and that the marketplace’s tools and templates were used to impersonate a wide range of institutions; The Verge listed affected sectors and the claimed geographic reach.

The pieces also say operators monetized the scheme, describing revenue in the aggregate as "tens of millions of dollars."