Microsoft and Japanese police target phishing market behind 1 billion messages
Microsoft said Oct. 14 that it was disrupting three parts of a Chinese-language cybercrime marketplace that has sent more than one billion malicious messages since January to people at more than 75,000 organizations in over 150 countries.
The services, called YAM Store, CoGUI and Iron Man, supplied the fake delivery, toll and tax messages that flood Canadian phones and inboxes. Among the template examples Microsoft published was an "Ontario toll notice," though the company stressed that appearing in a template does not mean an organization's systems were breached, according to its announcement.
What the services did
YAM Store sold fraudulent Microsoft and Google accounts and credential-theft tools. Operators sometimes bought expired domains that had belonged to non-profits and schools, rebuilt the websites and used them to obtain Microsoft 365 accounts for resale. CoGUI supplied ready-made fake websites that stole passwords and payment data, mainly from victims in Japan and the U.S. By mid-2026 it was being overtaken by Iron Man, which offers more than 2,300 templates impersonating banks, retailers, health care providers, transport authorities, police and governments.
More than 750 million of the messages targeted Microsoft customers, and many of those used device-code phishing to obtain sign-in tokens, BleepingComputer reported. Lures included undeliverable packages, unpaid tolls and traffic fines, overdue tax bills and account verification requests. The kits used geofencing, fake CAPTCHA pages and IP filtering to hide from researchers.
The disruption
The investigation began in late 2025 after Japan's National Police Agency alerted Microsoft. Under a U.S. District Court order in Florida, Microsoft and Health-ISAC seized and redirected domains supporting the three services. Microsoft said it disabled more than 20,000 YAM Store-linked accounts and blocked more than 100,000 impersonation domains. Partners included Japan's JC3, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.
What to do
- Treat texts about tolls, parcels, fines or tax refunds as suspect. Go to the agency's site or app yourself instead of following the link.
- Never enter a code on a Microsoft sign-in page because a message told you to; that is how device-code phishing works.
- Microsoft 365 administrators should restrict device code sign-in where it is not needed.
- Report scam messages to the Canadian Anti-Fraud Centre and forward spam texts to 7726.
