Microsoft and Japan's police take down YAM Store phishing marketplace
Microsoft says it worked with Japan's National Police Agency and others to dismantle YAM Store, a marketplace that sold fraudulent accounts and phishing kits linked to more than a billion malicious messages.
1 / 2
The story, neutrally told
Mixed · 2Microsoft says it helped dismantle YAM Store, an online marketplace for scammers sending phishing messages, after an investigation with Japan's National Police Agency (NPA). The VergeLC “Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world.” Read at The Verge ↗ ComputerworldN “Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages.” Read at Computerworld ↗ Mixed · 2Microsoft says YAM Store and the phishing kits sold through it enabled more than one billion malicious messages aimed at over 75,000 organisations, including more than 750 million sent to Microsoft customers, and generated tens of millions of dollars for the operators. The VergeLC “collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone” Read at The Verge ↗ ComputerworldN “ultimately generated “tens of millions of dollars” for criminal operators.” Read at Computerworld ↗ Left · 1The Verge reports the messages hit consumers, healthcare organisations, financial institutions and other businesses in more than 150 countries, and puts the period at since January 2026. The VergeLC “Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled”“in more than 150 countries” Read at The Verge ↗
Centre · 1Computerworld says the investigation began in late 2025, when the NPA told Microsoft about a wave of fraud and scam activity targeting people and businesses in Japan. Researchers expected separate campaigns but found what Microsoft called a "sprawling Chinese-language cybercrime marketplace". ComputerworldN “Investigation into the marketplace began in late 2025 after Japan’s National Police Agency (NPA) notified Microsoft of “a wave of fraud and scam activity””“sprawling Chinese-language cybercrime marketplace.”” Read at Computerworld ↗ Centre · 1According to Computerworld, the probe grew to involve other law enforcement agencies and companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Steven Masada of Microsoft's Digital Crimes Unit said AI tools helped connect accounts, websites and infrastructure that first looked unrelated. ComputerworldN “companies like Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.”“with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated” Read at Computerworld ↗ Mixed · 2The marketplace sold stolen or fraudulent Microsoft and Google accounts. Microsoft says operators registered expired domains of legitimate organisations, including non-profits and schools, and rebuilt them, and also created sites for nonexistent organisations, to obtain Microsoft accounts to resell. The VergeLC “scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages.” Read at The Verge ↗ ComputerworldN “criminal operators were able to register internet domains that legitimate organizations had allowed to expire, then rebuilt them to appear active.” Read at Computerworld ↗
Mixed · 2The Verge names two phishing kits, CoGUI and Iron Man; Computerworld names three popular kits, Iron Man System, CoGUI and Haozi. Iron Man, which Computerworld says came to the fore in mid-2026, offered more than 2,300 templates impersonating banks, police departments, government agencies, couriers and others across more than 150 countries. The VergeLC “a pair of phishing kits, CoGUI and Iron Man” Read at The Verge ↗ ComputerworldN “identified three popular PhaaS kits: Iron Man System, CoGUI, and Haozi.”“investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.” Read at Computerworld ↗ Left · 1Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 domains used for impersonation and fraud. With the non-profit Health-ISAC, it seized and redirected web domains that powered all three platforms. The VergeLC “Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud.”“Microsoft also seized and redirected web domains that were powering all three platforms.” Read at The Verge ↗ Centre · 1Computerworld adds that the kits used evasion techniques such as geofencing, fake CAPTCHA gates and IP blocklists. Microsoft said organisations appearing in templates were not necessarily compromised, and it advised passkeys, multifactor authentication, least-privilege and zero-trust practices, and checking with the purported sender before clicking login links. ComputerworldN “advanced evasion techniques such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists”“it does not indicate that its systems were compromised.”“passwordless tools like passkeys and multifactor authentication (MFA) across organizations.” Read at Computerworld ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- Short consumer-facing news item that opens with familiar scam texts and says people may see fewer of them, then relays Microsoft's figures.
- Emphasis
- Headline numbers, the two named kits, and Microsoft's disruption actions (accounts disabled, domains blocked and seized).
- Leaves out or plays down
- Does not mention Haozi, the Chinese-language nature of the marketplace, the other companies involved, or defensive advice.
- For example
-
“We’ve all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you’ll start seeing fewer of them.” — The Verge
Centre1 outlet
- Framing
- Longer trade-press analysis that treats the case as evidence of phishing-as-a-service becoming industrial, with technical detail and security advice for organisations.
- Emphasis
- How the marketplace worked, the investigation's origin in a Japanese tip, partner companies, evasion techniques and recommended defences.
- Leaves out or plays down
- Does not report the 20,000 disabled accounts, 100,000 blocked domains or the Health-ISAC domain seizures.
- Charged language
- “sprawling Chinese-language cybercrime marketplace”“goes industrial”
- For example
-
“As phishing-as-a-service goes industrial” — Computerworld
“What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”” — Computerworld
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- Microsoft and Japan's National Police Agency investigated and helped dismantle YAM Store.
- More than one billion malicious messages reached over 75,000 organisations, 750 million of them Microsoft customers, generating tens of millions of dollars.
- Iron Man offered more than 2,300 impersonation templates across more than 150 countries.
- CoGUI and Iron Man phishing kits were tied to the marketplace.
Where accounts differ
-
Number of phishing kits named and time frame
- Left
- The Verge names two kits (CoGUI and Iron Man) and dates the message count from January 2026.
- Centre
- Computerworld names three kits (Iron Man System, CoGUI, Haozi) and describes a nearly year-long investigation starting in late 2025.
Microsoft organisation
Presents the takedown as the result of cooperation with Japanese authorities and industry partners, and says the scale of such ecosystems lowers the barrier for less skilled criminals.
“the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry” — Computerworld
“Microsoft says it disabled over 20,000 accounts connected to YAM Store” — The Verge
National Police Agency (Japan) organisation
Japan's National Police Agency alerted Microsoft to a wave of fraud and scam activity in Japan, which started the investigation; the coverage gives no statement from the agency itself.
“Japan’s National Police Agency (NPA) notified Microsoft of “a wave of fraud and scam activity”” — Computerworld
Left1 article
-
Microsoft and Japan took down a cybercrime network behind over a billion scam messages
Neutral Brief explainer relaying Microsoft's report with a relatable consumer hook.
Centre1 article
-
Neutral Detailed account of the marketplace and Microsoft's findings, closing with defensive guidance; relies largely on Microsoft's statements.
Right0 articles
No coverage yet.
- 14 Oct 21:03 First The VergeLC Microsoft and Japan took down a cybercrime network behind over a billion scam messages
- 15 Oct 02:25 +5h 22m ComputerworldN As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…