75,000 organizations targeted by YAM Store network that sent 1 billion phishing messages globally
Microsoft and Japanese authorities dismantled a cybercrime network responsible for sending over 1 billion fraudulent messages to organisations worldwide.
Key points
- The YAM Store marketplace enabled the sending of more than one billion malicious messages since January 2026.
- Over 75,000 organisations were targeted, with more than 750 million messages directed at Microsoft customers.
- Operators used stolen accounts and phishing kits like CoGUI and Iron Man to impersonate legitimate entities.
The YAM Store phishing-as-a-service marketplace facilitated the distribution of over one billion malicious messages targeting organisations across more than 150 countries. According to Microsoft, this operation generated tens of millions of dollars for criminal operators by exploiting fraudulent accounts and ready-made phishing kits. The campaign specifically targeted consumers, healthcare providers and financial institutions using templates designed to mimic official communications from banks and police departments.
How it unfolded
- In late 2025, Japan’s National Police Agency alerted Microsoft to a surge in fraud targeting entities within Japan.
- Microsoft’s Digital Crimes Unit expanded the investigation globally, utilising AI tools to link disparate accounts, websites and infrastructure.
- Since January 2026, the YAM Store, alongside CoGUI and Iron Man kits, enabled the dispatch of over one billion messages.
- Microsoft disabled more than 20,000 connected accounts and blocked over 100,000 web domains used for impersonation.
Who is affected
Organisations in the healthcare, financial and business sectors faced targeted attacks through messages pretending to be about parking tickets or package deliveries. More than 75,000 organisations were impacted by this campaign, with Microsoft customers alone receiving over 750 million of the malicious messages. The operators resold fraudulent Microsoft and Google accounts purchased on the marketplace, allowing scammers to use these credentials for further scams.
The fix
No software patch addresses this marketplace-based threat, as the issue lies in criminal infrastructure rather than software vulnerabilities. Microsoft, in cooperation with international law enforcement and partners including Health-ISAC, seized and redirected domains powering the platforms. The company disabled thousands of associated accounts to halt ongoing activity. Users should monitor for unsolicited messages claiming to be from legitimate services and verify contact details through official channels.
What analysts watch for
Security teams should monitor for sudden spikes in authentication attempts from unfamiliar geographic locations or newly registered accounts. Analysts typically examine email headers for spoofed domain records and check URL shorteners for redirection to known malicious infrastructure. Reviewing user agent strings and session anomalies helps identify automated phishing kit deployments. Teams should verify the legitimacy of any domain that appears to be an expired registration of a trusted organisation.
Background: Phishing kits
A phishing kit is a downloadable software bundle containing fake login pages, scripts and instructions for setting up fraudulent websites. Attackers use these kits to harvest credentials by replicating legitimate services, reducing the technical skill required to launch sophisticated social engineering campaigns.
Read the full guide: Phishing Kits: Definition, Mechanics and Operational Reality
What to do and how to stay safe: Microsoft
- Verify the authenticity of unexpected messages by contacting the purported sender through a known, trusted channel.
- Review account activity logs for unauthorised login attempts or changes to recovery email addresses and phone numbers.
- Ensure all employee accounts use multi-factor authentication to reduce the risk of credential theft from phishing links.
- Monitor for reports of expired domains being re-registered by third parties to impersonate your organisation.
Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What was the YAM Store marketplace used for?
It served as a platform for cybercriminals to purchase stolen or fraudulent Microsoft and Google accounts and deploy phishing kits.
How many messages were sent through this network?
Since January 2026, the network enabled the sending of more than one billion malicious messages to organisations worldwide.
Which companies helped dismantle this operation?
Microsoft worked with Japan’s National Police Agency and partners including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.
