A global operation involving Microsoft, Japanese authorities, and cybersecurity companies has disrupted a large criminal network responsible for sending more than one billion phishing emails and text messages. The network targeted people and businesses in over 150 countries, using ready-made tools to impersonate trusted organizations and steal sensitive information.
The investigation began after Japan’s National Police Agency alerted Microsoft to widespread online fraud. What initially appeared to be separate phishing campaigns was eventually traced to a connected ecosystem of criminal services, including an underground marketplace called YAM Store.
YAM Store supplied cybercriminals with compromised or fraudulently obtained Microsoft and Google accounts, cloud resources, and other infrastructure. Its operators also exploited expired website domains belonging to legitimate organizations, rebuilding their websites to make fraudulent accounts and services appear trustworthy.
Investigators connected the marketplace to three phishing platforms known as CoGUI, Haozi, and Iron Man System. These services allowed criminals to launch attacks without developing their own phishing websites, significantly reducing the technical skills needed to conduct large-scale fraud.
Iron Man became particularly prominent during 2026. The platform offered more than 2,300 templates imitating banks, retailers, delivery companies, government agencies, and other organizations, allowing attackers to tailor phishing pages to different countries and industries.
Victims typically received phishing emails or SMS texts warning about unpaid road tolls, traffic fines, delivery problems, or accounts requiring verification. Links directed recipients to convincing imitation websites designed to collect passwords, payment card information and other personal details.
Some campaigns also used device-code phishing, which can trick users into authorizing access to their Microsoft accounts. The phishing platforms incorporated geographic restrictions, fake CAPTCHA checks and other mechanisms intended to frustrate security investigations.
Microsoft reported that the criminal ecosystem targeted more than 75,000 organizations worldwide. Since January 2026, over 750 million malicious messages were directed at Microsoft customers alone.
Using a court order issued in Florida, Microsoft and the Health Information Sharing and Analysis Center seized and redirected domains supporting the operation. Microsoft also disabled more than 20,000 associated accounts and blocked approximately 100,000 domains used for impersonation and fraud.
The investigation involved additional assistance from Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and Japanese cybersecurity organizations.
Although the disruption removed substantial criminal infrastructure, it does not establish that every associated operator has been identified or stopped. The findings also show how commercial phishing services can enable large-scale fraud by making sophisticated attacks accessible to criminals with limited technical expertise.