Microsoft and Japan police seize phishing marketplaces behind a billion malicious messages

Microsoft and Japan’s National Police Agency have moved against a phishing economy built around three Chinese-language marketplaces, after malicious messaging campaigns aimed at people and businesses in Japan prompted an investigation in late 2025.

The inquiry identified YAM Store, CoGUI and Iron Man as connected services that supplied the accounts, infrastructure and ready-made impersonation material needed to run large phishing campaigns. YAM Store sold fraudulent Microsoft and Google accounts alongside credential theft tools; CoGUI offered websites and messages made to resemble companies, financial institutions, government agencies and other trusted organisations; Iron Man provided thousands of templates for similar impersonation.

Since January 2026, the three platforms collectively enabled more than one billion malicious messages impersonating over 75,000 organisations worldwide. More than 750 million of those messages targeted Microsoft customers.

The campaign reached consumers, healthcare organisations, financial institutions and businesses in more than 150 countries, and generated tens of millions of dollars for the operators of the services.

Steven Masada, associate general counsel for Microsoft’s Digital Crimes Unit, described the volume of phishing as relentless. “these messages are relentless.”

CoGUI was used heavily against people in Japan. By the middle of 2026, cybercriminals had begun moving to Iron Man, whose customers could buy subscriptions offering thousands of templates tailored for Australia, Japan, India and dozens of other countries.

Investigators identified more than 2,300 Iron Man templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies.

Microsoft and Health-ISAC worked with the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs as they pursued legal action against the marketplaces.

On October 7, a United States District Court for the Southern District of Florida granted Microsoft and Health-ISAC an order to seize and redirect the domains that powered YAM Store, CoGUI and Iron Man.

Microsoft disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. Microsoft and Health-ISAC announced their cooperative effort to dismantle the three marketplaces on Wednesday.