Microsoft and the Japanese National Police Agency have dismantled a sprawling cybercrime ecosystem that operated like a legitimate app store for criminals, selling ready-made phishing kits and compromised access to corporate networks. The operation, which also involved Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs, targeted three interconnected services: The YAM Store, CoGUI and Iron Man.

What You Need to Know

The YAM Store functioned as an initial access broker, selling compromised access to Microsoft and Google environments. CoGUI provided phishing-as-a-service with browser fingerprinting and geofencing to evade detection. Iron Man replaced CoGUI during the investigation. Together, they sent over one billion malicious messages, with 750 million aimed at Microsoft customers.

A Marketplace Built for Scale

The YAM Store operated as what Microsoft calls an initial access broker, supplying criminals with compromised or fraudulently obtained environments in providers like Microsoft and Google. Its inventory stayed fresh through automation that identified expired organization names and leveraged legitimate customer data to bypass security filters.

CoGUI offered a phishing-as-a-service framework that initially stumped security software. It used browser fingerprinting and geofencing to avoid detection, allowing criminals to deploy convincing fake websites without hiring their own developers. Amazon was among the spoofed sites, alongside government agencies and financial institutions.

  • The YAM Store: An initial access broker selling compromised Microsoft and Google environments.
  • CoGUI: A phishing-as-a-service framework targeting Japan and US victims.
  • Iron Man: A replacement service that emerged during the investigation.

Why This Matters

The takedown signals a shift in how law enforcement and tech companies confront cybercrime. Rather than chasing individual scammers, authorities are now targeting the infrastructure that enables them. This approach could make it harder for criminals to launch large-scale phishing campaigns, but it also raises questions about how quickly replacement services will emerge.

For businesses, the disruption offers temporary relief. The YAM Store and its affiliates had targeted 75,000 organizations across more than 150 countries, sending over one billion malicious communications. With 750 million of those aimed at Microsoft customers, the operation had direct reach into corporate inboxes worldwide.

The Challenge of Chinese-Language Cybercrime

Investigators faced a significant hurdle: the entire operation was hosted in a wholly Chinese-language environment. Microsoft and the Japanese National Police Agency had to add native speakers to the team to infiltrate the YAM Store marketplace and gain access to its underground network.

This linguistic barrier highlights a broader challenge in international cybercrime investigations. Criminal networks often exploit language and jurisdictional gaps to evade detection. The collaboration between Microsoft, Japanese authorities and private cybersecurity firms demonstrates how public-private partnerships can bridge those gaps.

What Comes Next

Microsoft has seized domains associated with the YAM, CoGUI and Iron Man infrastructure, blocking or redirecting them. The company continues to work with law enforcement agencies worldwide to dismantle illegal operations targeting businesses and individuals.

The operation's success, however, does not guarantee a permanent solution. Cybercrime marketplaces are resilient, and new services often emerge to fill the void left by takedowns. The question now is whether authorities can maintain pressure on the ecosystem or if criminals will simply adapt and rebuild.