Microsoft shuts YAM Store, seizing CoGUI and Iron Man tools used for billion-message phishing spree

Microsoft led the dismantling of the YAM Store, a sprawling underground marketplace that enabled threat actors to conduct massive phishing operations. According to TechRadar, the investigation revealed a hub where criminals bought and sold digital accounts, hosting services, and spoofing tools. The operation drove more than one billion phishing messages before authorities seized the associated domains and thousands of compromised accounts.

In plain English

The YAM Store functioned as a centralized shop for cybercriminals needing infrastructure to launch scams. Instead of building fake websites from scratch, attackers purchased ready-made solutions. Microsoft reported that the platform offered fraudulent Microsoft and Google accounts, along with tools designed to steal credentials. This lowered the barrier to entry for fraudsters, allowing them to quickly deploy sophisticated-looking attacks against targeted organizations and individuals.

The background

The investigation began after Japan’s National Police Agency tipped Microsoft about a surge in fraud targeting local businesses and individuals. Researchers traced the activity back to the YAM Store, where they identified two primary tools: CoGUI and Iron Man. CoGUI provided a website-building framework for impersonating trusted entities, while Iron Man offered a gallery of templates. These tools allowed criminals to create convincing fake pages and messages designed to harvest passwords and payment data.

What changes now

With the marketplace dismantled, the specific infrastructure for these campaigns has been removed. Microsoft worked with private cybersecurity firms, including Proofpoint, and Japanese law enforcement to execute the takedown. The seizure of domains and accounts disrupts the immediate capability of these actors to use the YAM Store ecosystem. However, the tools themselves, such as the CoGUI framework and Iron Man templates, represent a model that may be replicated by other criminal groups in the future.

What made it possible

This incident highlights the risk of commoditized attack infrastructure. Threat actors rely on pre-built templates and stolen credentials to bypass initial trust barriers. Security teams should monitor for impersonation attempts that mimic trusted brands, as these tools lower the effort required for high-volume phishing. Organizations must verify the legitimacy of incoming communications, especially those requesting sensitive data. Relying solely on visual cues is insufficient, as these frameworks are designed to replicate official interfaces accurately.

What to do and how to stay safe: Microsoft

• Monitor email logs for messages containing links to newly registered or suspicious domains.
• Verify the sender's identity through a separate communication channel before clicking links.
• Review access logs for unusual login locations or times that may indicate credential theft.
• Educate users on recognizing generic phishing templates that mimic well-known organizations.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tools were used in the YAM Store phishing campaigns?

The campaigns utilized CoGUI, a website building framework, and Iron Man, a template gallery for impersonating trusted organizations.

How many phishing messages were sent via this network?

The operation drove over one billion phishing messages before the domains and accounts were seized.

Which organizations helped dismantle the YAM Store?

Microsoft led the effort alongside private cybersecurity companies like Proofpoint and law enforcement agencies from Japan.