Scammers Ran an Online Store. One of Its Customers Was Microsoft

A text about an unpaid traffic fine or a stuck package can look like the work of one lone con artist. Microsoft says many of these messages trace back to a store. On October 14, 2026, Microsoft and the non-profit Health-ISAC announced they are moving to dismantle three linked services in a Chinese-language cybercrime marketplace: YAM Store, CoGUI and Iron Man.¹

The services sold scammers what they needed to get started: fraudulent accounts, ready-made fake websites and message templates. Under an order from the US District Court for the Southern District of Florida, which a judge granted on October 7, the partners seized and redirected domains that formed part of the infrastructure behind all three.¹² The idea is to go after the suppliers, not just the scams they make possible.

“The scam message is often the only part victims see. The businesses behind it are what make it possible.”

That was Steven Masada, general manager of Microsoft’s Digital Crimes Unit, in the company’s announcement.¹

How the scam shop worked

YAM Store ran like an online shop. It sold fraudulent Microsoft and Google accounts and other ready-made scam tools, including tools for credential theft (stealing people’s usernames and passwords). Microsoft confirmed how the store worked partly through controlled purchases. In other words, some of YAM Store’s customers were Microsoft.¹

CoGUI supplied ready-made websites and messages that impersonated companies, banks and government agencies. It was widely used against victims in Japan and the US. By mid-2026, it was increasingly being replaced by Iron Man.¹

Iron Man offered more than 2,300 templates impersonating banks, retailers, healthcare providers, transport authorities, police and government agencies in more than 150 countries. The templates covered email, texts and web pages, including fake traffic-fine and parcel-delivery messages.¹

Microsoft’s security researchers say Iron Man began being advertised through YAM Store in June 2026. They describe the kits as commercially licensed phishing-as-a-service products, meaning scam tools licensed out much like a software subscription.³

A big number, with fine print

Microsoft estimates that since January 2026 the three services enabled more than 1 billion malicious messages aimed at more than 75,000 organizations worldwide, including more than 750 million aimed at Microsoft customers.¹² That figure is Microsoft’s own estimate of messages the services made possible. It is not a count of texts that landed on individual phones.

Targets included consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries. Microsoft says the services generated tens of millions of dollars for their operators.¹²

The tip came from Japan

The investigation began in late 2025, when Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. The agency went on to provide intelligence and investigative support, while Microsoft and Health-ISAC led the legal action.¹²

Other partners included the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft says it also shared intelligence with the US Secret Service and international law enforcement. AI tools helped investigators connect pieces of infrastructure that at first looked unrelated.¹²

What changes, and what doesn’t

The court order is a temporary restraining order, and Cybersecurity Dive reports it cuts off the sites at least temporarily. This was a civil action and domain seizure. No arrests or charges have been reported.²

Microsoft has also disabled more than 20,000 accounts connected to YAM Store, continues to remove infrastructure hosted on its services, and has blocked more than 100,000 domains used for impersonation and fraud.¹

The company is clear that this won’t end scam messages. Masada said in the announcement:

“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.”