Microsoft announces an operation against fraudulent marketplace YAM Store

Microsoft says it helped dismantle a marketplace catering to scammers following an investigation with Japan's National Police Agency. According to The Verge's account, the operation concerns YAM Store as well as the phishing tools CoGUI and Iron Man.

According to Microsoft, these services collectively enabled more than one billion malicious messages to be sent since January 2026, targeting more than 75,000 organizations. These figures were provided by the company: the excerpt offers no independent verification of these volumes.

YAM Store notably allowed users to buy stolen or fraudulent Microsoft and Google accounts. Microsoft says the service also acquired expired domains belonging to real organizations and created websites for fictitious organizations to obtain accounts for resale. The phishing tools then facilitated the sending of fraudulent messages.

The company says it has disabled more than 20,000 accounts linked to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. Together with Health-ISAC, it also seized and redirected domains used by the services concerned.

The operation therefore targets several resources needed for these campaigns: accounts, domains and distribution tools. It could make the campaigns harder to sustain. However, the available information does not allow the actual decline in fraudulent messages after the intervention to be measured, nor does it establish that all of the operators' activity has ceased.