'What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation': Microsoft leads global takedown of phishing network which sent over a billion messages

In a recent operation, Microsoft played a key role in dismantling a global phishing network that sent over a billion messages. This network utilized platforms such as CoGUI and Iron Man to enable large-scale phishing campaigns targeting organizations worldwide. The operation successfully seized domains and thousands of accounts, ultimately driving a billion phishing messages before the domains and accounts were taken down.

Last year, Microsoft launched an investigation into a seemingly ordinary phishing campaign, only to discover a much larger Chinese-language cybercrime marketplace where threat actors bought, traded, and sold digital accounts, web hosting services, and tools for creating spoofed websites and fake identities. The investigation started when Japan's National Police Agency alerted Microsoft about a surge in fraud and scam activity targeting individuals and businesses in the country.

Researchers uncovered a major underground marketplace called YAM Store, where fraudulent Microsoft and Google accounts were offered for sale, along with ready-made tools for carrying out scams, including credential theft. Two prominent tools within the marketplace were CoGUI, a website building framework, and Iron Man, a template gallery.

CoGUI supplied criminals with pre-designed websites and messages impersonating trusted organizations, making it easier for them to carry out password theft, payment information theft, and other forms of data theft. By mid-2026, CoGUI was largely replaced by Iron Man, which offered over 2,300 templates for impersonating trusted organizations, including banks, retailers, healthcare providers, and police departments.

These templates were available in more than 150 countries worldwide, with the tool facilitating more than a billion phishing messages aimed at 75,000 organizations around the world this year. Microsoft customers alone received more than 750 million of these messages since the beginning of the year, leading to tens of millions of dollars in profits for the operation's operators.

Microsoft and its partners, including private cybersecurity companies and law enforcement agencies from Japan, seized and redirected the domains associated with YAM Store, CoGUI, and Iron Man. They also disabled over 20,000 accounts linked to the marketplace and are continuing to dismantle the operation by removing infrastructure hosted on their services.

By taking down infrastructure like YAM Store, CoGUI, and Iron Man, Microsoft has made it harder for cybercriminals to access the accounts, tools, and infrastructure they rely on for their criminal activities.