Microsoft and Japan’s National Police Agency have dismantled a massive cybercrime network behind over a billion scam messages. The operation targeted a marketplace called YAM Store and two phishing kits, CoGUI and Iron Man. Since January 2026, these tools have enabled more than one billion malicious messages to target over 75,000 organizations worldwide, with over 750 million directed at Microsoft customers alone.

Scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages. The marketplace also hijacked real organizations’ expired web domains, creating websites for nonexistent entities to steal more accounts. The Iron Man platform offered over 2,300 templates for impersonating legitimate organizations, making it easier for fraudsters to trick users.

Microsoft disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud. With the help of Health-ISAC, a health sector cybersecurity non-profit, Microsoft seized and redirected web domains powering all three platforms. This operation marks a significant victory in the ongoing battle against cybercrime.

The scale of the operation—disabling nearly 20,000 accounts and blocking over 100,000 domains—underscores the coordinated effort required to combat such widespread cybercrime. With these efforts, users may see a decline in the barrage of fake parking tickets and mysterious package notifications that can be so frustrating.