YAM Store and the Global Phishing Supply Chain

Oswaldo Royett

Oct 18

6 min read

How Microsoft, Japan’s National Police Agency and industry partners disrupted a transnational scam marketplace

1B+

malicious messages enabled since January 2026

75,000+

organizations targeted worldwide

150+

countries represented in campaigns

A coordinated operation led by Microsoft and supported by Japan’s National Police Agency (NPA) has disrupted a Chinese-language cybercrime ecosystem built to industrialize phishing. The network centered on YAM Store, an underground marketplace that sold fraudulently acquired cloud environments and accounts, while companion services CoGUI and Iron Man supplied ready-made phishing pages, messages and impersonation templates. Microsoft says the three services enabled more than one billion malicious messages since January 2026, targeting over 75,000 organizations in more than 150 countries.[1]

The action is significant because it focused on the suppliers behind the scams, not only on the messages that reach a victim’s phone or inbox. Microsoft and Health-ISAC seized and redirected domains associated with the services under an order from the U.S. District Court for the Southern District of Florida. Microsoft also reported disabling more than 20,000 accounts connected to YAM Store and blocking more than 100,000 domains used for impersonation and fraud.[2]

The investigation began in Japan

The case started in late 2025, after Japan’s NPA alerted Microsoft to malicious messaging campaigns aimed at people in Japan. What first looked like a collection of separate scams led investigators to a shared commercial infrastructure. Intelligence from the Japan Cybercrime Control Center (JC3), which draws on more than 130 member organizations, helped connect incidents affecting Japanese companies, financial institutions and consumers.[1]

The cross-border investigation brought together Microsoft’s Digital Crimes Unit, Health-ISAC, the NPA, JC3, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft also worked with the U.S. Secret Service and other international law-enforcement partners. Their combined data linked accounts, websites, hosting resources and payment activity that had appeared unrelated when viewed one incident at a time.[1][3]

YAM Store: an illicit online shop for access

Microsoft describes YAM Store as an initial access broker, a service that obtains and resells the building blocks other criminals need. Customers could browse listings, compare prices and buy fraudulent Microsoft and Google accounts, cloud environments, licenses, storage and related tools. Controlled purchases helped investigators confirm that the marketplace operated like a commercial storefront rather than an informal one-off operation.[1]

Image: Microsoft’s screenshots of YAM Store listings and its Telegram business channel. Source: Microsoft, “Disrupting the service economy behind transnational cybercrime operations.”

The supply chain sometimes began with expired domains that had once belonged to legitimate nonprofits or educational institutions. Operators could rebuild those websites so they appeared active, then use the fabricated identity to obtain Microsoft 365 environments that could later be sold. Microsoft’s technical analysis says the operators also used automation to identify suitable tenants, manage stolen application credentials and monetize storage and licenses.[4]

The model lowered the skill and cost barriers for downstream criminals. A buyer did not need to create a convincing organization, acquire a cloud tenant, configure hosting or design a fake login page from scratch. The marketplace packaged those steps into products that could be ordered and reused at scale.

CoGUI and Iron Man turned impersonation into a service

CoGUI supplied ready-made websites and messages that impersonated banks, companies, technology providers and government agencies. These pages were designed to collect passwords, payment information and other personal data. The service was especially active against victims in Japan and the United States, according to Microsoft’s partner reporting.[3]

Iron Man represented a newer layer of the same business. Investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and public agencies across more than 150 countries. The templates could be adapted to email, SMS and web campaigns in several languages.[1][3]

Image: examples of multilingual Iron Man impersonation templates identified by Microsoft. The presence of a named organization does not mean that organization’s systems were compromised. Source: Microsoft.

The targets ranged from parcel-delivery services and tax offices to traffic authorities, airlines and financial institutions. A familiar logo or official-looking warning could create urgency: a delivery supposedly held at customs, a traffic penalty nearing its deadline or a request to update a payment method. The technical trick was simple, but the surrounding infrastructure made it repeatable across countries, brands and languages.

A disruption aimed at the business model

On October 7, 2026, a federal judge in Florida granted Microsoft and Health-ISAC’s request to take control of the relevant domain names. The organizations then seized or redirected domains powering YAM Store, CoGUI and Iron Man. Microsoft said it was continuing to remove infrastructure hosted on its services and block domains involved in impersonation and fraud.[2]

Image: Microsoft takedown notice showing the participating organizations and law-enforcement partners. Source: Microsoft.

The operation does not erase phishing. Criminal groups can rebuild websites, register new domains and move between hosting providers. Yet removing a central access broker and two widely used kit services raises the cost of restarting. Buyers must find new accounts, recreate templates, establish delivery infrastructure and rebuild trust within their own criminal market.[3]

That is why the case is best understood as a supply-chain disruption. The visible scam message is only the final step. Behind it may be a marketplace, an account broker, a template developer, a hosting service, a domain manager and a payment channel. Attacking several connected services at once can produce more friction than blocking a single campaign after it has already reached victims.

What organizations should take from the case

Organizations should treat unexpected sign-in prompts, new application permissions and unusual tenant activity as possible security events. Microsoft’s technical report points to abuse of application credentials, privileged directory access, SharePoint and OneDrive storage, and DNS control. Defenders should review service principals, administrative roles, app permissions, dormant accounts and recently created domains, especially where activity does not match normal business use.[4]

For employees and consumers, the most useful habit is to resist the demand for immediate action. Do not open a link merely because a message mentions a fine, a delivery, a tax refund or a locked account. Visit the organization through a known website or official app, inspect the sender and domain carefully, and report suspicious messages through the employer’s security process or the service provider’s abuse channel.

Closing Thoughts

The YAM Store case shows that digital fraud is no longer organized only around individual scammers sending deceptive messages. It can be supported by a marketplace that sells access, templates, hosting and identities as repeatable services. That structure changes the defensive question: instead of asking only how to spot the next fake text, investigators also need to ask who supplies the accounts, domains and tools that make thousands of fake texts possible.

The most constructive part of this operation is the collaboration. Japan supplied the initial warning, Microsoft traced activity across its cloud ecosystem, and security and intelligence partners added views that no single organization could have assembled alone. The result is a reminder that cybercrime crosses borders quickly, while investigations often move at the speed of information sharing.

What does this actually mean?

It means a large criminal service chain has lost important infrastructure and access points, but the underlying criminal demand remains. Some campaigns should become harder to launch, at least in the short term. The takedown should not be read as proof that every message from these operators has disappeared or that phishing has been solved.

It also means cloud accounts, domains and legitimate-looking websites have become valuable parts of the fraud economy. A compromised or fabricated business identity can be as useful to an attacker as malware. Security teams therefore need visibility into identity, applications, domains and data storage—not only traditional endpoint alerts.

How does this impact us?

For individuals, the practical impact is a stronger reason to verify urgent messages outside the message itself. Use bookmarked websites, official apps and known phone numbers. For companies, it is a reason to audit cloud identities and third-party applications, enforce multi-factor authentication, remove unused privileges and monitor new domains or tenants that imitate the organization.

For public agencies and technology providers, the case supports deeper cooperation across sectors. A bank may see the payment lure, a hospital may see the impersonated brand, and a cloud provider may see the account abuse. Sharing those fragments can expose the common supplier behind them sooner.