Microsoft and Japan took down a cybercrime network behind over a billion scam messages

Microsoft says it worked with Japan’s National Police Agency to dismantle YAM Store, a marketplace used to send phishing messages tied to fake deliveries, parking tickets, and similar scams. The operation also targeted two phishing kits, CoGUI and Iron Man, which Microsoft says helped enable more than one billion malicious messages against over 75,000 organizations globally.

The takedown shows how scam-text operations are increasingly run like commercial platforms, with reusable kits and marketplaces lowering the barrier for criminals. Coordinated public-private action may reduce some message volume, but the scale suggests phishing-as-a-service will remain a persistent threat as operators regroup or migrate to new infrastructure.