Microsoft’s Digital Crimes Unit (DCU) and the Japan National Police Agency (NPA) have dismantled a massive transnational “Phishing-as-a-Service” (PhaaS) network responsible for more than one billion malicious messages. The operation, authorized by a legal order from the U.S. District Court for the Southern District of Florida on October 7, 2026, targeted a marketplace known as the YAM Store and several prolific phishing kits used to automate cyberattacks.
Since January 2026, the network facilitated a relentless volume of scams, with over 750 million messages specifically targeting Microsoft customers. In total, the infrastructure reached more than 75,000 organizations worldwide, deploying deceptive messages that impersonated banks, telecommunications providers, and government agencies.
The Anatomy of a Phishing-as-a-Service Ecosystem
The disrupted operation functioned as a service economy for cybercriminals. At its center was the YAM Store, which Microsoft intelligence tracks as Storm-3119. This marketplace sold access to compromised accounts and specialized tools, allowing low-skill attackers to launch sophisticated campaigns.
Supporting the marketplace were two major phishing kits—CoGUI and Iron Man—tracked under the designation Storm-2990. These kits provided the technical backbone for the scams:
- Iron Man: Contained more than 2,300 pre-built templates designed to mimic traffic authorities and financial institutions across 139 countries.
- CoGUI: Focused on automating the theft of credentials and session tokens to bypass multi-factor authentication (MFA).
As part of the technical takedown, Microsoft disabled over 20,000 accounts linked to the YAM Store and is currently blocking more than 100,000 domains used to host fraudulent content.
How Scammers Bypassed Security Filters
A primary reason for the network’s high delivery rate was its use of “recycled” domains. To bypass automated security filters that often block newly registered domains, the operators behind Storm-3119 purchased expired domains previously owned by legitimate nonprofit organizations and educational institutions.
By repurposing .edu and .org domains that already had established reputations, the attackers could deliver phishing links that appeared trustworthy to email gateways. These sites were often used to host fake “unpaid toll” notices or “package delivery” alerts, which have become a common nuisance for mobile and email users globally.
The investigation into this infrastructure began in late 2025, following a tip from the Japan National Police Agency regarding a surge in messaging scams within Japan. According to a report from Microsoft, the investigation led to the court order that ultimately severed the network’s command-and-control links.
Impact on Users and Organizations
While the infrastructure seizure significantly disrupts the current volume of messages from these specific kits, security experts note that the PhaaS model remains a persistent threat. The removal of over 100,000 domains provides immediate relief for spam filters, but organizations that may have been targeted—estimated at 75,000 globally—are encouraged to review their logs for signs of credential harvesting or unauthorized access linked to the “Storm” tracking numbers.
The takedown highlights a shift toward targeting the “middlemen” of the cybercrime world. By dismantling the marketplaces and kit developers that enable thousands of individual scammers, law enforcement and private sector partners aim to raise the cost and complexity of launching global phishing campaigns.
