Based on reporting by The Verge.
What happened
Microsoft disabled more than 20,000 accounts linked to the YAM Store marketplace and blocked over 100,000 web domains used for impersonation and fraud, doing so in coordination with Japan’s National Police Agency.
The YAM Store marketplace, together with the phishing kits CoGUI and Iron Man, had generated more than one billion malicious messages since January 2026, including over 750 million messages directed at Microsoft customers.
The scam messages were aimed at consumers, healthcare organizations, financial institutions and other businesses across more than 150 countries.
The Iron Man platform alone offered over 2,300 templates that allowed scammers to impersonate a wide range of organizations.
Microsoft, working with the Health‑ISAC, seized and redirected the web domains that powered the three phishing platforms.
AIBeat analysis
This could lower the volume of phishing attacks reaching Microsoft users and reduce exposure for sectors such as healthcare and finance, because the takedown removes a large pool of ready‑made templates and the infrastructure that delivered them; however, the scale of the earlier campaign suggests that additional malicious actors may still be able to rebuild similar operations.