AI-rewritten: This is a summary of an article from The Verge, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.

---

Microsoft and Japan’s National Police Agency worked together to dismantle a cybercrime network known as YAM Store, which facilitated scams involving stolen accounts and phishing kits. Through this investigation, the agencies disabled over 20,000 accounts connected to the marketplace and blocked more than 100,000 web domains used for impersonation. Microsoft also seized and redirected domains that powered all three platforms involved in the operation.

Since January 2026, YAM Store along with two phishing kits called CoGUI and Iron Man has enabled over one billion malicious messages targeting more than 75,000 organizations globally. These attacks have reached consumers, healthcare providers, financial institutions, and other businesses across more than 150 countries. Microsoft notes that over 750 million of these messages were specifically directed at its own customers, generating tens of millions of dollars for the scammers.

The YAM Store marketplace allowed buyers to purchase stolen or fraudulent Microsoft and Google accounts, which they used with phishing kits like Iron Man to send deceptive texts. The Iron Man platform alone offered over 2,300 templates enabling scammers to impersonate entities such as banks and police departments. Additionally, the network hijacked real organizations’ expired web domains to create fake websites for nonexistent companies, a tactic Microsoft says helped them resell stolen accounts.