Microsoft disables accounts linked to YAM Store phishing network

Organisations in more than 150 countries face exposure from a massive phishing operation that has now been disrupted. Microsoft states it helped dismantle the YAM Store marketplace, which facilitated over one billion malicious messages. This network specifically targeted consumers, healthcare providers, and financial institutions, generating tens of millions of dollars for its operators through credential theft and fraud.

Which accounts and data were compromised?

The YAM Store marketplace allowed criminals to purchase stolen or fraudulent Microsoft and Google accounts. According to The Verge, scammers used these purchased identities to send scam messages impersonating banks, police departments, and other trusted entities. The platform also hijacked expired web domains from real organisations to create fake websites, which were then used to generate new Microsoft accounts for resale.

How large was the operation?

Since January 2026, the YAM Store network and its associated phishing kits, CoGUI and Iron Man, enabled the sending of more than one billion malicious messages. CSO Online reports that over 750 million of these messages were directed at Microsoft customers alone. The operation targeted more than 75,000 organisations worldwide, with tools arranged by environment types such as educational or non-profit sectors to increase credibility.

How was the network identified?

The investigation began in late 2025 after Japan’s National Police Agency alerted Microsoft to a wave of fraud targeting people and businesses in Japan. Computerworld notes that researchers discovered a sprawling Chinese-language cybercrime marketplace rather than isolated campaigns. Microsoft’s Digital Crimes Unit used AI tools to connect unrelated accounts, websites, and infrastructure, revealing the broader criminal operation behind the scams.

What actions were taken to stop it?

Microsoft disabled over 20,000 accounts linked to the YAM Store network. The company also blocked more than 100,000 web domains used for impersonation and fraud. Working with Health-ISAC, Microsoft seized and redirected domains powering the YAM Store, CoGUI, and Iron Man platforms. These actions were part of a nearly year-long investigation involving international authorities and several technology companies.

What affected people can do

Staff should verify the legitimacy of unexpected messages claiming to be from banks or internal systems. Check whether the sender’s domain matches the official organisation address exactly. Look for urgent language demanding immediate action or payment. Report suspicious emails to your security team immediately. Monitor account activity for unauthorised logins. Change passwords if you clicked links in recent suspicious messages. Be wary of follow-up scams claiming to resolve the initial issue.

What to do and how to stay safe: Microsoft

• Verify sender domains against known official addresses before clicking any links.
• Report suspicious messages to your internal security team for analysis.
• Monitor account activity for unauthorised access or unusual login locations.
• Change credentials if you interacted with a suspicious message or link.

Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What was YAM Store?

YAM Store was a cybercrime marketplace that sold stolen accounts and phishing tools, enabling over one billion scam messages.

How many organisations were targeted?

The network targeted more than 75,000 organisations worldwide, including healthcare and financial institutions.

Did Microsoft disable any accounts?

Yes, Microsoft disabled over 20,000 accounts connected to the YAM Store marketplace.