Microsoft Helps Japanese Police Take Down Major Phishing Marketplace

A large-scale international cyber operation has succeeded: with the active assistance of Microsoft and cybersecurity experts, Japanese law enforcement agencies have managed to dismantle a major shadow marketplace called YAM Store. This platform served as a central hub for cyberattack organizers, specializing in the sale of vulnerabilities, the seizure of websites and corporate accounts, and the provision of infrastructure for mass phishing campaigns.

Scale of Cybercrime and Attack Tools

According to official investigation data, since January of this year, malicious actors have used the platform to send over 1 billion phishing messages targeting more than 75,000 organizations and countless individual users across more than 150 countries worldwide. The main tools for automating attacks were specialized software packages CoGUI and Iron Man, the latter of which offered cybercriminals over 2,300 ready-made email templates disguised as official requests from banking institutions and government agencies.

Shadow Business Mechanisms and Financial Profits

The syndicate's operational activities brought its organizers tens of millions of US dollars in profits. The criminal scheme included buying and reselling stolen user accounts from popular Microsoft and Google ecosystems, hacking expired domains of third-party companies to legitimately distribute malicious traffic, and creating fake web resources of non-existent organizations to thoroughly conceal traces of illegal activity.

Contradictory Data

While analyzing the scale of the incident, experts draw attention to certain discrepancies in reports regarding the targeted audience: general statistics indicate coverage of 75,000 organizations worldwide, while Microsoft's customer protection directly recorded over 750 million targeted malicious emails directed at the corporate sector. Discrepancies also concern the exact division of roles between the creators of the Iron Man software and the operators of the YAM Store marketplace, whose financial flows investigators continue to study in detail.

Operation Results and Infrastructure Liquidation

Thanks to close cooperation between tech giants, the Japanese police, and the non-profit organization Health-ISAC, more than 20,000 accounts directly linked to YAM Store operations were successfully blocked. Furthermore, law enforcement and security specialists managed to intercept and take control of over 100,000 web domains used by fraudsters to conduct their sophisticated cyberattacks.