Microsoft Dismantles Major Criminal Marketplace Responsible for Over a Billion Malicious Messages
In a significant development in the fight against cybercrime, Microsoft has announced the dismantling of a notorious criminal marketplace that facilitated the distribution of over one billion malicious messages. This initiative was the culmination of nearly a year-long investigation, conducted in collaboration with international law enforcement and several tech and cybersecurity firms. The spotlight was primarily on a coordinated underground network called Yam Store, which operated as a phishing-as-a-service (PhaaS) platform.
The Yam Store was notorious for enabling cybercriminals to easily purchase pre-made kits specifically designed for executing phishing attacks aimed at stealing sensitive data and credentials. This underground operation was uncovered following a tip-off from Japanese authorities regarding a surge in fraud and scam activities targeting both individuals and businesses in Japan.
According to Steven Masada, associate general counsel and general manager for Microsoft’s Digital Crimes Unit, the inquiry began with a relatively straightforward investigation that expanded significantly as the team utilized artificial intelligence tools to connect various accounts, websites, and infrastructure that initially seemed unrelated. “What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation,” Masada elaborated in a blog post detailing the findings.
Unveiling the PhaaS Marketplace
The Yam Store and the various kits it offered were instrumental in the transmission of more than one billion messages, affecting over 75,000 organizations globally. Notably, Microsoft customers accounted for more than 750 million of these messages, which collectively resulted in “tens of millions of dollars” in profit for the operators behind the crime.
The investigation was initiated late in 2025 when Japan’s National Police Agency (NPA) alerted Microsoft to the increasing instances of fraud. Researchers anticipated discovering multiple individual phishing campaigns, but what they found was a sprawling Chinese-language cybercrime marketplace. This revelation led to a global probe involving various law enforcement agencies and additional tech firms such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
Operating as an initial access broker (IAB), the Yam Store functioned similarly to an e-commerce platform but specialized in selling fraudulent Microsoft and Google accounts along with other tools used to perpetrate scams. Customers had the ability to browse, compare prices, and purchase these illicit resources. The offerings included tools tailored for specific websites—arranged by age, type of subscription, and the nature of the target, such as educational institutions (.edu) or organizations (.org).
Tactics and Evolution of Tricky Kits
Researchers discovered that some criminal operators ingeniously registered expired internet domains of legitimate organizations, rebuilding them to seem active again. This tactic allowed them to target specific sectors, such as non-profits and educational institutions, to fraudulently acquire Microsoft 365 accounts, which were later sold through the Yam Store.
The investigation revealed the evolution of the marketplace in tandem with the release of various kits. Three particularly influential PhaaS kits identified during the probe were the Iron Man System, CoGUI, and Haozi. The Iron Man System, in particular, gained prominence in mid-2026; it featured pre-built lure pages designed to capture any information victims submitted. These lure sites impersonated a variety of legitimate entities, including government agencies, banks, and healthcare providers.
Through extensive testing and intelligence work, investigators uncovered over 2,300 templates impersonating organizations across more than 150 countries. The Iron Man System represented a significant leap in the PhaaS model, enabling criminals to quickly deploy elaborate phishing pages that mimicked the appearance of official authority to coerce victims into revealing sensitive personal information.
Additionally, the kits incorporated advanced evasion tactics such as geofencing, fake CAPTCHA gates, and configurations meant to avoid detection. This technological sophistication made these phishing attempts even more challenging to identify.
Promoting Cyber Hygiene
In conjunction with this alarming discovery, Microsoft researchers have stressed the importance of "cyber hygiene," especially in recognizing phishing lures that often present clear scam indicators, such as urgent and time-sensitive tasks. They recommend that users become familiar with common phishing techniques and regularly verify the legitimacy of requests from purported senders before clicking on links.
Moreover, researchers emphasize that organizations should implement robust security measures to fortify their defenses against phishing attacks. Suggested initial steps include transitioning towards passwordless tools and multifactor authentication (MFA), alongside promoting principles of least privilege and zero trust. These measures are crucial in slowing down potential threat actors while granting defenders additional time to respond.
The insights gathered from this comprehensive investigation not only underscore the extensive capabilities of sophisticated cybercriminal networks but also highlight the pressing need for individuals and organizations alike to bolster their cybersecurity protocols. In a world increasingly dependent on digital interactions, understanding the nuances of cyber threats is vital for safeguarding sensitive information against malicious actors.