Microsoft Disrupts Cybercrime Network Targeting 75,000 Organizations Across 150 Countries
Microsoft has taken action to disrupt three components of a cross-border cybercrime network that supplied accounts, tools and infrastructure for online fraud and impersonation. The operation involved Health-ISAC, cybersecurity partners and law enforcement agencies and targeted services known as Yam Store, Koji and Iron Man.
Microsoft said the services had sent more than 1 billion malicious messages since January 2026, targeting over 75,000 organizations worldwide. More than 750 million messages were directed at Microsoft customers. The campaigns reached victims in more than 150 countries, including consumers, healthcare providers, financial institutions and other businesses, generating tens of millions of dollars for the operators.
Investigation traced activity to a criminal marketplace
The investigation began in late 2025 after Japan's National Police Agency alerted Microsoft to malicious messaging campaigns targeting individuals and organizations in Japan. Further analysis uncovered a large Chinese-language criminal marketplace where fraudsters could purchase accounts, hosting services and tools for creating fake websites instead of developing their own infrastructure.
Japan's Cybercrime Control Center and cybersecurity companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs contributed to the investigation, alongside other partners. Their work helped connect seemingly unrelated incidents and identify the services supporting the operations.
How Yam Store, Koji and Iron Man operated
Koji supplied ready-made websites and messages impersonating businesses, financial institutions, government agencies and other trusted organizations. The materials were designed to steal passwords, payment details and personal information. Microsoft identified fake pages mimicking Amazon's Japanese website that asked users to enter login credentials or update bank card information.
Yam Store operated as an online marketplace where buyers could browse listings, compare prices and purchase Microsoft and Google accounts for fraud and credential theft. Test purchases by Microsoft confirmed how the service worked.
Investigators also found that operators acquired expired internet domains previously owned by legitimate organizations, particularly nonprofits and educational institutions. They rebuilt associated websites to make them appear active, fraudulently obtained Microsoft 365 accounts and offered them for sale through Yam Store.
As Koji's activity gradually declined, Iron Man gained prominence by mid-2026. The service offered thousands of templates mimicking official websites and communications, enabling criminals to create campaigns across email, text messages and the web tailored to specific brands, industries and countries.
Test purchases and cooperation with Resecurity helped investigators access Iron Man and identify more than 2,300 impersonation templates. These imitated banks, retailers, healthcare providers, transport agencies, police departments, government bodies and other organizations across more than 150 countries.
The templates covered multiple sectors, languages and markets, including banking, airlines, telecommunications, parcel delivery and fee collection. Some messages claimed recipients owed traffic fines or faced parcel-delivery problems, directing them to links to make payments or disclose sensitive information.
Microsoft stressed that the appearance of an organization's name in these templates does not mean its systems were compromised. The campaigns relied on impersonation and fraudulent websites to deceive customers. Information gathered by Japan's cybercrime center through a network of more than 130 member organizations helped establish the scale of activity targeting Japanese businesses, financial institutions and their customers.
Court order enables infrastructure disruption
Microsoft and Health-ISAC obtained an order from the U.S. District Court for the Southern District of Florida authorizing the seizure and redirection of internet domains linked to infrastructure supporting Yam Store, Koji and Iron Man.
Microsoft said it had disabled more than 20,000 accounts associated with Yam Store. It is also removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.
The company worked with the U.S. Secret Service and international law enforcement partners. Investigators also used artificial intelligence tools to connect accounts, websites and infrastructure that initially appeared unrelated.
Microsoft said the case illustrates how modern fraud increasingly relies on specialized commercial services that help criminals reach larger numbers of victims. Disrupting the three services targets the suppliers providing accounts, tools and infrastructure, rather than focusing on fraudulent messages alone.