Cybercrime Network Behind More Than 1 Billion Scam Messages Disrupted

Microsoft and Japanese authorities have dismantled a cybercrime network responsible for sending more than 1 billion fraudulent messages across over 150 countries. More than 20,000 accounts were disabled during the operation.

Microsoft, in cooperation with Japan's National Police Agency, has disrupted the operations of a global cybercrime network linked to hundreds of millions of fraudulent messages worldwide.

According to Microsoft's statement, a marketplace called YAM Store, along with phishing tools known as CoGUI and Iron Man, facilitated the distribution of more than 1 billion malicious messages since January 2026. These messages targeted consumers, healthcare organizations, financial institutions, and other businesses across more than 150 countries.

Microsoft reported that over 75,000 organizations were targeted as part of these activities. More than 750 million messages were specifically directed at Microsoft customers. The individuals behind these cybercriminal operations reportedly generated tens of millions of dollars in revenue through these methods.

Stolen Accounts and Phishing Tools Were Used

According to Microsoft's investigation, YAM Store operated as a marketplace where fraudsters could purchase stolen or fraudulent Microsoft and Google accounts. Cybercriminals combined these accounts with phishing tools such as CoGUI and Iron Man to distribute fraudulent messages on a massive scale.

The attacks primarily targeted the United States and Japan, although malicious activities were reported in nearly every country.

These messages typically attempted to deceive users through fake package delivery notifications, nonexistent parking fines, and alerts impersonating legitimate corporate services.

Such messages could be used to steal account credentials or redirect victims to fraudulent websites. Impersonated services included Amazon, Netflix, and YouTube.

However, YAM Store's activities extended beyond these methods. According to Microsoft, the platform also exploited expired domain names previously owned by legitimate organizations and used them for fraudulent activities.

Additionally, it created websites impersonating nonexistent organizations. Microsoft accounts obtained through these methods were subsequently offered for resale.

Thousands of Templates Created for Fraudulent Activities

The Iron Man platform used by the cybercrime network provided an extensive library of templates designed to make fraudulent messages appear more convincing.

According to Microsoft, the platform contained more than 2,300 templates that could be used to impersonate organizations such as banks and law enforcement agencies.

These templates enabled fraudsters to impersonate various institutions and send deceptive messages to their targets more easily.

As a result, the same infrastructure could be used in campaigns targeting individuals and organizations across multiple countries.

More Than 20,000 Accounts Disabled

Following its investigation in cooperation with Japan's National Police Agency, Microsoft disabled more than 20,000 accounts associated with YAM Store.

The company also blocked over 100,000 internet domains used for impersonation and fraudulent activities.

The operation was supported by Health-ISAC, a nonprofit organization focused on cybersecurity within the healthcare sector.

Microsoft and its partners seized control of the internet domains supporting the operations of all three platforms and redirected their traffic to disrupt the criminal infrastructure.

Some of the Measures We Should Take to Protect Against Such Attacks Include;

• Phishing awareness should be increased, and users should avoid clicking suspicious links in emails and SMS messages.

• Multi-factor authentication (MFA) should be implemented to strengthen account security.

• Email security controls, including SPF, DKIM, and DMARC, should be implemented, and malicious links should be filtered.

• Fake and malicious domains should be blocked using DNS security solutions.

• SIEM and security monitoring solutions should be used to detect unusual login attempts and suspicious account activities.

• Compromised accounts should be identified, active sessions terminated, passwords reset, and access permissions reviewed.

For more information, please contact our cybersecurity experts at info@zerosecond.ae.