Since the beginning of 2026, a transnational cybercrime network sent over 1.1 billion malicious messages — including phishing emails, fraudulent SMS texts, and fake notifications — to more than 75,000 organizations across 150 countries. On Wednesday, October 14th, Microsoft announced the dismantling of this infrastructure through a coordinated operation with Japan's National Police Agency (NPA), the Japanese Cybercrime Control Centre (JC3), Health-ISAC, and international partners including Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs.
What began as a wave of fraudulent activity targeting people and businesses in Japan turned out to be far more than isolated scam campaigns. Investigators uncovered an organized cybercrime ecosystem built on three interdependent layers: an initial access marketplace (YAM Store), ready-to-use phishing kits (CoGUI and Iron Man), and massive hosting infrastructure for fraudulent messaging.
The underground economy of cybercrime
YAM Store, also tracked as Storm-3119, operated like an online shop where criminals could buy compromised or fraudulently obtained Microsoft and Google accounts and environments. Operators could browse by price, compare subscription types, select domains tied to real or expired organizations, and even create entire companies from scratch — using AI-generated content and documentation.
In compromised Microsoft environments, operators used stolen application credentials to manage accounts and licenses, and abused SharePoint and OneDrive storage to host malicious material. Microsoft says it has already disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 domains used for impersonation and fraud.
The second layer consisted of the phishing kits themselves. CoGUI, tracked as Storm-2990, provided ready-made websites and messages impersonating trusted companies, financial institutions, and government agencies. It was heavily used to target people in Japan and the United States. Iron Man — which became the preferred kit by mid-2026 — offered more than 2,300 pre-built templates for impersonating postal services, traffic fine offices, tax agencies, banks, telecommunications carriers, and retailers. Iron Man was offered as a phishing-as-a-service with subscriptions that provided access to thousands of templates tailored for over 130 countries.
Resecurity, which participated in the investigation, analyzed Iron Man's exposed infrastructure and found a public Git/container registry with 911 published builds and eight registered accounts. Inside, researchers identified a product-selection subsystem linked to payment-card capture, cataloging 2,360 phishing packages covering 130 countries and areas, with updates through October 1, 2026.
Messages that look real
The messages sent through these kits were meticulously crafted. CoGUI included fake notifications for unpaid tolls, traffic fines, delivery problems, and account verification requests. Iron Man went further, supporting geofencing, fake CAPTCHA gates, and IP filtering to hinder security analysts' detection efforts.
Research showed that the three kits — CoGUI, CoAceV, and CoFish_Ws — used more than 17,000 domains. Campaigns identified by Proofpoint in late 2024 consistently targeted Japan, with attackers impersonating well-known Japanese companies and international organizations to steal credentials and payment data.
Microsoft 365 was the primary target. Since January 2026, attackers sent more than 750 million malicious messages to Microsoft 365 customers, many using device-code phishing to obtain authentication tokens — a technique that bypasses multi-factor authentication (MFA) by tricking the user's own session rather than their password.
Why infrastructure matters
The most revealing aspect of this operation is that it dismantled not just what criminals do, but how they acquire what they need. YAM Store represented a form of "as a service" that democratized cybercrime: instead of needing technical skills to compromise servers, configure fake domains, or write phishing scripts, a malicious actor could simply visit a marketplace, pick what they needed, and start sending fraudulent messages.
This explains why the scale was so enormous — over 75,000 organizations in 150 countries. When crime is modularized and sold as a service, the barrier to entry drops dramatically. Anyone with internet access and a payment method can become a phishing operator, and the only limit is the creativity of the kit they chose.
The investigation began in late 2025 when the NPA alerted Microsoft to malicious campaigns. What investigators expected to find — a series of isolated scams — turned out to be an organized, industrial-scale operation with three components working together as a criminal supply chain. YAM Store provided the raw materials (compromised accounts), the phishing kits were the production tools, and the hosting infrastructure was the distribution channel.
Microsoft has disabled more than 20,000 accounts and continues removing infrastructure from its services. The question remains whether dismantling these three components will be enough to dismantle a network that, like other cybercrime operations, may simply reorganize in another format — or whether the legal and technical pressure applied by Microsoft, Health-ISAC, and their international partners will be sufficient to make the YAM Store economic model unviable. The phishing-as-a-service market does not disappear with a single judicial blow; it adapts. What matters now is whether the investigators' response is keeping pace with the speed at which digital crime reinvents itself.
Sources: The Verge, BleepingComputer, The Record from Recorded Future
✓ Independent sources cross-checked and verified before publishing
