You know the text. “You have an unpaid toll. Pay now to avoid a penalty.” Or the package that supposedly could not be delivered. On October 14, Microsoft said it had dismantled a big part of the factory behind them: a cybercrime marketplace called YAM Store, plus two phishing kit operations, CoGUI and Iron Man, taken down in a joint action with Japan’s National Police Agency and Health-ISAC.
What got taken down
Three services, one marketplace. YAM Store, which Microsoft tracks as Storm-3119, sold compromised or fraudulently obtained Microsoft and Google accounts, licenses, and cloud storage to other criminals. The phishing kits, CoGUI and the Iron Man System (tracked together as Storm-2990), supplied ready-made scam templates and lures.
The scale is hard to picture. Since January 2026, the three services enabled more than one billion malicious messages, email and SMS combined, aimed at over 75,000 organizations in more than 150 countries. Over 750 million of those messages targeted Microsoft customers specifically. The operators earned tens of millions of dollars, according to Steven Masada, general counsel of Microsoft’s Digital Crimes Unit.
How the factory worked
YAM Store’s operators bought up expired domains belonging to real organizations, then rebuilt the websites so defunct entities looked active again. With those borrowed identities, they obtained legitimate cloud accounts. In at least one observed case, they generated entire fake organizations, complete with content and documentation, using AI tools.
The kits did the rest. Iron Man alone offered more than 2,300 customizable templates impersonating banks, retailers, delivery services, and government agencies. CoGUI focused on victims in the United States and Japan before Iron Man pushed it aside around mid-2026. The lures were the classics: unpaid tolls, traffic penalties, delivery problems, account verification requests. Behind the scenes, the kits used geofencing, fake CAPTCHA gates, and IP filtering to dodge security researchers, plus device-code phishing to steal authentication tokens.
The enforcement behind it
This was a civil legal action, not a police raid with handcuffs. Acting under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected the domains running YAM Store, CoGUI, and Iron Man. Microsoft disabled more than 20,000 accounts tied to YAM Store and says it is blocking over 100,000 domains used for impersonation and fraud.
The investigation started in late 2025, when Japan’s National Police Agency flagged a surge of scam activity to Microsoft. Partners in the action included Japan’s Cybercrime Control Center, plus Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs. Microsoft published the full technical breakdown on its Security Blog on October 14.
I got those texts. What changes for me?
Honestly, not much changes overnight. The toll and package texts may thin out for a while, but phishing infrastructure gets rebuilt constantly. What does not change: no legitimate toll agency, delivery company, or bank asks you to pay or verify through a link in an unsolicited text. Treat every one of those messages as hostile until proven otherwise.
- Delete the text. Do not tap the link, do not reply, do not call any number in it.
- Check the claim directly. Open the toll agency or delivery company’s official site or app yourself and look for the notice there.
- Report it. Forward the message to 7726 (SPAM) so your carrier can flag the sender.
- Turn on spam filtering. Both iPhone and Android have built-in unknown-sender filtering; switch it on in your messaging settings.
What the takedown did not do
Two honest caveats. First, no source confirms any arrest, criminal charge, or conviction tied to this case. The action seized infrastructure; the people behind it have not been publicly identified. Microsoft itself has not confirmed the operators’ nationality, though some outlets describe the marketplace as Chinese-language. Second, takedowns like this are whack-a-mole by nature. Microsoft is still blocking those 100,000-plus domains as an ongoing effort, which tells you the rebuilding has already started.
Sources
- BleepingComputer: Global takedown hits network behind 1 billion phishing messages (Oct 2026)
- Rappler: Microsoft, partners disrupt phishing kit ecosystem (Oct 15, 2026)
- Gigazine: Microsoft and Japan took down cybercrime network (Oct 15, 2026)
- Tech Times: Microsoft, Japan took down phishing network behind global scams (Oct 15, 2026)
