Microsoft said this week it has helped the Japanese National Police Agency dismantle a criminal marketplace that sold ready-made phishing kits to scammers, an operation the company says sent more than a billion fraudulent messages to victims in over 150 countries.
The takedown targeted three connected services: YAM Store, CoGUI and Iron Man. Together they functioned less like a single scam and more like a supply chain for scammers, handing out pre-built fake websites and message templates so criminals with no coding skill could run convincing fraud campaigns. Amazon was among the brands spoofed, alongside government agencies and financial institutions, according to Microsoft.
Microsoft says 75,000 organizations were targeted through the network, and that 750 million of the malicious messages were aimed specifically at its own customers. The company worked alongside Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs to trace and disrupt the infrastructure, then seized or redirected the domains tied to it.
A moving target
CoGUI, the phishing-as-a-service framework at the center of the operation, initially evaded standard security filters by using browser fingerprinting and geofencing, techniques that let it serve a convincing fake page to a real victim while showing something harmless to a researcher or a bot. It was, for a time, aimed primarily at targets in Japan and the United States.
Midway through the investigation, CoGUI was replaced by a newer service called Iron Man, suggesting the operators behind it were actively working to stay ahead of the companies tracking them. Microsoft has given the broader marketplace the internal tracking name Storm-3119, and describes it as an "Initial Access Broker," the kind of operation that doesn't necessarily run scams itself but sells the tools and the entry points for others to do so, supplying "compromised or fraudulently obtained environments in providers like Microsoft and Google."
Investigators also found an automation layer built to keep the marketplace's inventory current. According to Microsoft, the system identified "expired environment or organization names and leverages legitimate customer information associated with them to help circumvent existing detections," effectively recycling abandoned accounts and company names to slip past fraud checks that would otherwise flag reused or suspicious identities.
A Chinese-language marketplace
Getting inside YAM Store, the underground storefront where the kits changed hands, wasn't straightforward. Microsoft says the entire ecosystem operated in Chinese, and investigators had to bring native speakers onto the team before they could gain the access needed to map the network and its customers.
Microsoft hasn't said whether any individuals behind YAM Store, CoGUI or Iron Man have been identified or charged, and the Japanese National Police Agency hasn't released further detail beyond the joint announcement. For now, the company's action is limited to seizing and redirecting the domains that kept the storefront and its phishing kits running.
What happens next depends largely on whether the operators resurface under a new name, the way CoGUI gave way to Iron Man mid-investigation. Microsoft and its partners say they'll keep monitoring the infrastructure for signs the marketplace, or something built to replace it, comes back online.
TBFiled by The Tech Business Desk
Big tech, startups, earnings, regulation and policy — the decisions that shape the products.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.