YAM Store Takedown: How Microsoft Hit a 1B-Message Phish Hub

Microsoft has taken down YAM Store, an online marketplace that supplied criminals with fake accounts and phishing tools, along with two phishing-kit services called CoGUI and Iron Man. Announced on October 14 by Microsoft's Digital Crimes Unit, the operation targeted infrastructure that Microsoft says enabled more than 1 billion malicious messages since January 2026. It is a strong example of how coordinated legal action, industry partnerships and AI-assisted investigation can disrupt phishing at its source rather than one email at a time.

• Scale: more than 1 billion malicious messages since January 2026, over 750 million of them aimed at Microsoft customers.
• Reach: more than 75,000 organizations targeted across more than 150 countries.
• Action: over 20,000 YAM Store accounts disabled and more than 100,000 impersonation and fraud domains blocked.
• Legal basis: a US District Court order let Microsoft and Health-ISAC seize and redirect the services' domains.

What Was YAM Store?

YAM Store worked like a supply shop for phishing crews. According to Microsoft, it sold fraudulent Microsoft and Google accounts and scam tools that made it easy to send convincing messages at huge volume. Its partner services filled in the rest of the toolkit: CoGUI supplied ready-made fake websites and impersonation messages, while Iron Man offered more than 2,300 templates for imitating real brands. Help Net Security reports that the Iron Man catalog covered more than 139 countries.

This is the phishing-as-a-service model in action. Instead of building their own lures, attackers rent polished kits, which is why disrupting the suppliers has an outsized effect.

How Did AI Help the Investigation?

The case began in late 2025, when Japan's National Police Agency alerted Microsoft to messaging campaigns targeting people in Japan. Tracing those campaigns led investigators to the wider marketplace. Microsoft says that, with the help of AI tools, its team connected accounts, websites and infrastructure that at first looked unrelated.

That is where AI earns its place in modern threat intelligence. Phishing operators spread their infrastructure across thousands of throwaway domains and accounts specifically to stay hidden. Pattern-matching across that much data is slow for people and fast for machines, and it turned scattered signals into a map of a single operation.

Who Took Part in the Takedown?

This was a team effort. Alongside Microsoft's Digital Crimes Unit and Health-ISAC, partners included Japan's National Police Agency, the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and the US Secret Service. Microsoft tracks the YAM Store operation as Storm-3119 and the phishing-kit developers as Storm-2990, and it has published a threat intelligence write-up so defenders can check their own environments. Help Net Security notes that operators like these often try to rebuild under new domains, which is why the domain blocking continues after the initial action.

What Should Organizations Do Now?

The takedown removes a big supplier, but good habits keep the next one from succeeding:

• Review Microsoft's Storm-3119 and Storm-2990 guidance and check mail logs for related indicators.
• Use phishing-resistant sign-in such as passkeys or FIDO2 keys, so a stolen password alone is not enough.
• Train staff on brand impersonation, since template kits copy real login pages closely. Our guide to invisible Unicode phishing tricks covers one technique worth knowing.

Like the Sality botnet takedown earlier this year, this operation shows defenders increasingly going after the infrastructure behind attacks. Follow more stories like this in our AI security coverage.

Sources: Microsoft On the Issues, Disrupting the service economy behind transnational cybercrime operations — October 14, 2026; Help Net Security, Microsoft disrupts phishing kits marketplace YAM Store — October 15, 2026.