---
title: "Microsoft Helps Japanese Police Take Down Major Phishing Marketplace"
description: "With Microsoft's assistance, Japanese police shut down the YAM Store marketplace, through which scammers sent over 1 billion phishing emails."
date: 2026-10-15T11:34:40.016Z
lang: en
url: https://xab.info/en/posts/microsoft-helps-japanese-police-take-down-phishing-marketplace
tags: [microsoft, cybersecurity, phishing, japan, yam-store]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Microsoft Helps Japanese Police Take Down Major Phishing Marketplace

![Microsoft logo and digital security concept](https://xab.info/media/2026/10/15/microsoft-pomogla-yaponskoy-politsii-nakrit-marketpleys-phishing/microsoft-pomogla-yaponskoy-politsii-nakrit-marketpleys-phishing-1.webp)

## Key Points

- The YAM Store marketplace, responsible for over 1 billion phishing emails, has been shut down.
- The operation was supported by Microsoft, Japanese police, and Health-ISAC.
- Attackers utilized CoGUI and Iron Man software, harming organizations across 150 countries.

A large-scale international cyber operation has succeeded: with the active assistance of Microsoft and cybersecurity experts, Japanese law enforcement agencies have managed to dismantle a major shadow marketplace called YAM Store. This platform served as a central hub for cyberattack organizers, specializing in the sale of vulnerabilities, the seizure of websites and corporate accounts, and the provision of infrastructure for mass phishing campaigns.

### Scale of Cybercrime and Attack Tools

According to official investigation data, since January of this year, malicious actors have used the platform to send over 1 billion phishing messages targeting more than 75,000 organizations and countless individual users across more than 150 countries worldwide. The main tools for automating attacks were specialized software packages CoGUI and Iron Man, the latter of which offered cybercriminals over 2,300 ready-made email templates disguised as official requests from banking institutions and government agencies.

### Shadow Business Mechanisms and Financial Profits

The syndicate's operational activities brought its organizers tens of millions of US dollars in profits. The criminal scheme included buying and reselling stolen user accounts from popular Microsoft and Google ecosystems, hacking expired domains of third-party companies to legitimately distribute malicious traffic, and creating fake web resources of non-existent organizations to thoroughly conceal traces of illegal activity.

### Contradictory Data

While analyzing the scale of the incident, experts draw attention to certain discrepancies in reports regarding the targeted audience: general statistics indicate coverage of 75,000 organizations worldwide, while Microsoft's customer protection directly recorded over 750 million targeted malicious emails directed at the corporate sector. Discrepancies also concern the exact division of roles between the creators of the Iron Man software and the operators of the YAM Store marketplace, whose financial flows investigators continue to study in detail.

### Operation Results and Infrastructure Liquidation

Thanks to close cooperation between tech giants, the Japanese police, and the non-profit organization Health-ISAC, more than 20,000 accounts directly linked to YAM Store operations were successfully blocked. Furthermore, law enforcement and security specialists managed to intercept and take control of over 100,000 web domains used by fraudsters to conduct their sophisticated cyberattacks.

## Fact-Check & Sources

- [Microsoft помогла японской полиции накрыть целый маркетплейс для распространителей фишинговых сообщений window-new](https://3dnews.ru/1149945/microsoft-pomogla-yaponskoy-politsii-nakrit-tseliy-marketpleys-dlya-rasprostraniteley-fishingovih-soobshcheniy) - Данные полностью подтверждают масштабы рассылки, имена платформ (YAM Store, CoGUI, Iron Man) и участие Microsoft.

## FAQ

### What marketplace was dismantled with Microsoft's participation?

The shadow marketplace YAM Store, which specialized in selling phishing tools and stolen data, was shut down.

### How many phishing messages were sent through this network?

Since January of this year, attackers have sent over 1 billion phishing messages worldwide.