Microsoft and Japan police shut YAM Store, the scam marketplace behind over 1 billion phishing messages

Microsoft says it has helped dismantle YAM Store, an online marketplace for scammers, along with two phishing kits called CoGUI and Iron Man, after an investigation with Japan's National Police Agency, The Verge reported. Since January 2026 the three platforms enabled more than 1 billion malicious messages, Microsoft says.

The scale, in numbers

• 1 billion+ scam messages since January 2026
• 750 million+ of them aimed at Microsoft customers
• 75,000+ organisations targeted, in more than 150 countries
• Tens of millions of dollars earned by the operators
• 20,000+ accounts disabled and 100,000+ web domains blocked by Microsoft

How the scam machine worked

YAM Store sold stolen or fraudulent Microsoft and Google accounts. Scammers bought them and used the CoGUI and Iron Man kits to send phishing messages in bulk. To get fresh accounts to resell, YAM Store took over expired web domains of real organisations and built websites for organisations that did not exist.

The Iron Man kit offered more than 2,300 ready-made templates to impersonate banks, police departments and other organisations: the fake parking fine, the parcel that "could not be delivered", the bank warning that your account is about to be blocked. Targets included consumers, hospitals, banks and other businesses.

With Health-ISAC, a health-sector security group, Microsoft also seized and redirected the web domains that ran all three platforms.

Why this matters in Pakistan

The same tricks land on phones in Pakistan every day: fake courier messages, fake prize alerts, and messages that pretend to be your bank, a mobile wallet or a government department. One marketplace shut down will not end them, so the basics still apply:

1. Never share an OTP, PIN or card number by SMS, call or WhatsApp. No bank or wallet asks for it.
2. Do not tap links in unexpected messages about parcels, fines or blocked accounts. Open the official app or type the website yourself.
3. Call the number on the back of your card, not one given in a message, if you are unsure.
4. Check the sender. A message from an ordinary mobile number claiming to be a bank is a red flag.
5. If you clicked, change your passwords, turn on two-step verification, and tell your bank at once.

For more on staying safe with your bank and phone, see our guides on banking and telecom.