Microsoft and Japan dismantle cybercrime marketplace behind billions of phishing texts
Microsoft, working with Japan's National Police Agency, disabled a large network that facilitated over a billion scam messages worldwide.
In collaboration with Japan's National Police Agency, Microsoft disrupted a cybercrime ecosystem centered on the YAM Store marketplace and the phishing kits CoGUI and Iron Man. These tools enabled scammers to dispatch over one billion fraudulent messages, affecting roughly 75,000 organizations across more than 150 nations, including a large volume aimed at Microsoft customers. The attackers sold stolen or fabricated Microsoft and Google accounts and hijacked expired domains to create fake sites for resale.
Microsoft shut down more than 20,000 accounts tied to the marketplace and blocked over 100,000 domains used for deception. Together with the health-sector nonprofit Health-ISAC, the company seized and redirected the domains that supported all three platforms.
Why it matters
Stopping the network curtails a major source of global phishing attacks and protects millions of users and organizations.
In this story
