Many people are familiar with fake text messages claiming that a package delivery failed or a parking ticket is unpaid. Now, investigators have disrupted a massive criminal network that helped scammers send more than one billion of these fraudulent messages to people and organizations in over 150 countries.
The scam operation relied on an online marketplace called YAM Store and two phishing toolkits known as CoGUI and Iron Man. In phishing attacks, criminals send deceptive messages to trick victims into revealing sensitive personal data or financial details. On YAM Store, scammers could buy stolen or fake Microsoft and Google accounts to send messages, while the Iron Man service provided over 2,300 templates designed to impersonate banks, police departments, and other trusted institutions.
Since January 2026, these platforms targeted consumers, hospitals, financial companies, and more than 75,000 organizations worldwide. Microsoft reported that more than 750 million of the messages targeted its users alone. The sellers also hijacked expired website domains from legitimate groups and created fake company sites to obtain accounts to resell, generating tens of millions of dollars for the network operators.
Microsoft collaborated with Japan's National Police Agency and the healthcare cybersecurity organization Health-ISAC to take down the infrastructure. The team disabled more than 20,000 accounts linked to YAM Store, blocked over 100,000 domains used for fraud, and seized the web addresses that kept the three platforms running.