As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages
Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages. Working with international authorities and several tech and cybersecurity companies in a nearly year-long investigation, Redmond identified and took down Yam Store, a coordinated underground network dealing in commercial phishing-as-a-service (PhaaS). The network allowed cybercriminals to readily…
Microsoft has dismantled a criminal marketplace called Yam Store, which was responsible for sending 1 billion malicious messages. The operation involved a year-long investigation with international authorities and various tech companies. The marketplace allowed cybercriminals to purchase pre-made phishing kits and tools to steal data and credentials.
The investigation was initiated after Japan's National Police Agency reported a surge in fraud and scam activity. The YAM Store operated similarly to an online marketplace, selling fraudulent Microsoft and Google accounts and other tools used for scams. The marketplace had three popular kits: Iron Man System, CoGUI, and Haozi. Iron Man System emerged in mid-2026 and provided pre-built lure pages that impersonated various organizations to trick victims into disclosing sensitive information.
The kits also featured advanced evasion techniques, making it easier for criminals to carry out phishing attacks. The scale of the operation highlights the availability of criminal infrastructure, enabling less skilled cybercriminals to target organizations at scale. Microsoft emphasizes the importance of cyber hygiene, recommending users to verify sender information, avoid clicking suspicious links, and implement strong password policies and multi-factor authentication.
Written by urgent.news from Computerworld's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
