Microsoft announced on Wednesday (14) an international operation against services used to distribute digital scams on a large scale. With support from authorities and security partners, the company shut down more than 20,000 accounts and blocked more than 100,000 domains associated with a criminal infrastructure that sold ready-made tools for fraud.
According to the company, three services identified as YAM Store, CoGUI and Iron Man enabled more than 1 billion malicious messages since January 2026, targeted at consumers and more than 75,000 organizations in more than 150 countries. Of that total, more than 750 million targeted Microsoft customers.
The operation also involved Health-ISAC, an organization specializing in healthcare sector security. With authorization from a federal court in Florida, in the United States, the entities took control of and redirected domains used by the services under investigation.
The figures released represent the scale of the campaigns associated with the infrastructure, not the number of victims who actually had data stolen or suffered financial losses.
Criminal market sold accounts, fake sites and phishing tools
The investigation revealed a commercial structure in which different suppliers offered the resources needed to carry out fraudulent campaigns, eliminating the need for buyers to develop their own tools.
YAM Store operated as a clandestine online store. Its catalog included Microsoft and Google accounts obtained fraudulently, licenses and storage resources that could be used to sustain criminal operations.
In certain cases, those responsible acquired expired domains from legitimate organizations and rebuilt their sites to simulate commercial or institutional activities. These identities were used to obtain accounts on cloud services, which were later resold.
CoGUI and Iron Man, in turn, provided pages and messages that imitated known institutions. Iron Man, sold by subscription, brought together more than 2,300 phishing templates, including fakes of banks, retailers, shipping companies and government agencies.
The templates made it possible to reproduce scams involving failed deliveries, toll charges, fines and supposed problems with bank accounts. The goal was to induce users to provide passwords, personal data or payment information.
The commercial division between infrastructure providers and sellers of phishing tools is one of the main findings of the investigation. Those responsible for the campaigns could purchase accounts, services and fraudulent pages from specialized operators, reducing the technical knowledge required to carry out the scams.
According to Microsoft, this network of services generated tens of millions of dollars for its operators.
The investigation began in late 2025, after Japan's National Police Agency alerted Microsoft to fraudulent campaigns in the country. The work later involved organizations such as Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.
Although the operation hit important components of this structure, Microsoft itself acknowledges that YAM Store, CoGUI and Iron Man represent only part of a broader criminal network. The company says it continues to remove infrastructure associated with the identified activities.
