{
  "id": 16092489,
  "title": "Microsoft helped shut down an “App Store” for criminals linked to over a billion malicious messages",
  "url": "https://urgent.news/2026/10/22/microsoft-helped-shut-down-an-app-store-for-criminals-linked-to-over",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T19:20:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/microsoft-helped-shut-down-an-app-store-for-criminals-linked-to-over-a-billion-malicious-messages"
  },
  "original_language": "en",
  "account": "In a significant collaboration, Microsoft joined forces with the Japanese National Police Agency to dismantle three Chinese-language cybercrime \"app stores\" named the YAM Store, CoGUI, and Iron Man. These illicit platforms had targeted over 75,000 organizations across more than 150 countries, sending out more than one billion malicious messages, resulting in millions of dollars in criminal profits. The operation, which also involved Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs, aimed at Microsoft's customers alone sent 750 million fraudulent messages.\n\nThe investigation revealed that the trio of cybercrime app stores provided criminals with pre-fabricated fake websites and messages. These were designed to deceive targets, making them believe they were interacting with legitimate entities. Amazon was among the fake sites on sale, allowing scammers to host convincing pages to steal login and payment credentials without the need for coding skills. Other false sites were created to mimic government agencies, financial institutions, and well-known companies.\n\nInitially, security filtering software struggled to detect the CoGUI phishing-as-a-service (Phaas) framework. It used sophisticated methods to avoid being detected, including browser fingerprinting and geofencing. The YAM Store, Iron Man, and CoGUI were all part of a Chinese-language environment, requiring the involvement of native speakers to infiltrate. Microsoft assigned a tracking number, Storm-3119, to the marketplace, describing it as an \"Initial Access Broker.\" This platform provided customers with compromised or fraudulently obtained environments from providers like Microsoft and Google.\n\nMicrosoft seized domains associated with the YAM/CoGUI/Iron Man infrastructure, blocking or redirecting them. The operation successfully disrupted this criminal marketplace, showcasing the importance of international cooperation between law enforcement agencies and technology companies in the fight against cybercrime.",
  "summary": "Microsoft’s joint op with the Japanese National Police Agency uncovered an illegal “app store” that provided fake websites, cybercrime tools, and even accounts to cybercriminals.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}