Global Cybercrime Takedown Disrupts Network Behind 1 Billion Phishing Messages

An international law enforcement operation has disrupted a major cybercrime network linked to more than one billion malicious messages targeting over 75,000 organizations across 150 countries.

The operation followed an investigation involving Microsoft and Japan’s National Police Agency, which uncovered an underground marketplace known as YAM Store, alongside several phishing-as-a-service platforms used to conduct large-scale online fraud.

According to Microsoft, more than 750 million malicious messages targeted its customers through email and SMS since the beginning of 2026, highlighting the scale of the threat facing businesses and individuals.

How the Phishing Network Operated

Investigators linked YAM Store to phishing kits known as CoGUI, Haozi and Iron Man. These tools allowed cybercriminals to launch campaigns impersonating legitimate organizations, including banks, retailers, delivery companies and government agencies.

YAM Store reportedly supplied compromised or fraudulently obtained cloud accounts, software licenses and storage environments associated with Microsoft and Google. Operators also acquired expired organizational domains and used fabricated business identities, sometimes created with AI tools, to obtain cloud services.

The phishing campaigns relied on familiar lures, including unpaid traffic fines, delivery problems and requests to verify accounts. Some kits also used fake CAPTCHA checks and IP-based filtering to make malicious websites harder for security researchers to investigate.

Microsoft reported that the campaigns frequently used device-code phishing, a technique designed to trick victims into authorizing access and potentially exposing authentication tokens.

Alongside employee awareness and account security, understanding how firewalls help protect networks can help organizations strengthen their cybersecurity defenses.

Microsoft Disrupts Thousands of Accounts and Domains

As part of the coordinated response, Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) obtained a U.S. court order to seize and redirect domains supporting YAM Store and associated phishing operations.

Microsoft also deactivated more than 20,000 accounts connected to YAM Store and blocked 100,000 domains associated with impersonation and fraud.

Cybersecurity firm Resecurity contributed to the investigation, identifying exposed infrastructure linked to the Iron Man platform. The broader effort involved Japanese authorities and several technology and security organizations, including Cloudflare, Oracle, Proofpoint and TRM Labs.

Further infrastructure removals are ongoing as investigators continue to identify systems associated with the operation.

According to Microsoft’s investigation into the phishing network, YAM Store supplied accounts, licenses and cloud infrastructure that helped criminals conduct large-scale phishing campaigns.

What This Means for Businesses and Users

The takedown demonstrates how phishing has evolved into a commercial cybercrime ecosystem, where attackers can purchase ready-made tools and infrastructure instead of building campaigns themselves.

For users, the key lesson is to treat unexpected messages requesting payments, account verification or urgent action with caution. Avoid signing in through links in unsolicited messages, and verify requests through official websites or applications.

Organizations should strengthen multi-factor authentication, monitor suspicious login activity, restrict access to cloud resources and train employees to recognize phishing attempts.

The bottom line: Disrupting YAM Store and its associated phishing infrastructure is a significant step against large-scale online fraud. However, businesses and individuals must remain vigilant because cybercriminals can migrate to replacement services and infrastructure.