As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages.

Working with international authorities and several tech and cybersecurity companies in a nearly year-long investigation, Redmond identified and took down Yam Store, a coordinated underground network dealing in commercial phishing-as-a-service (PhaaS).

The network allowed cybercriminals to readily purchase, and very quickly deploy, pre-made kits they could use in phishing attacks to steal data and credentials.

Microsoft said the takedown began as a simple investigation based on a tip from Japanese authorities.

“Working together, and with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them,” Steven Masada, associate general counsel and GM for Microsoft’s Digital Crimes Unit, wrote in a blog post. “What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”

The evolving PhaaS marketplace

Collectively, YAM Store and the kits and tools sold within it enabled the sending of more than 1 billion messages to 75,000-plus organizations worldwide. More than 750 million of those were sent to Microsoft customers alone, and ultimately generated “tens of millions of dollars” for criminal operators. 

Investigation into the marketplace began in late 2025 after Japan’s National Police Agency (NPA) notified Microsoft of “a wave of fraud and scam activity” targeting people and businesses in Japan. Researchers expected to find multiple individual campaigns; instead, they discovered a “sprawling Chinese-language cybercrime marketplace.” The probe expanded globally and involved the efforts of several other law enforcement agencies, as well as companies like Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

The YAM Store served as an initial access broker (IAB), operating much like an online marketplace; in this case, the merchandise was fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams like credential and data theft. Customers could browse, compare prices, and make purchases. Available tools were arranged based on age and subscription and environment types (like .edu or .org sites).

In some cases, criminal operators were able to register internet domains that legitimate organizations had allowed to expire, then rebuilt them to appear active. They targeted specific sectors (like non-profits or education) to fraudulently obtain Microsoft 365 accounts to later sell through the YAM store.

The researchers discovered that the YAM Store evolved as different kits became available, and identified three popular PhaaS kits: Iron Man System, CoGUI, and Haozi.

The newer Iron Man system came to the fore in mid-2026. It provided pre-built lure pages capturing any victim-submitted data. The lure sites impersonated healthcare providers, police departments, government agencies, postal and courier services, toll and transportation authorities, tax agencies, banks, telecoms, and retailers. Through test purchases and intelligence work, investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.

Iron Man effectively expanded the PhaaS model by giving criminals access to thousands of ready-made templates tailored to specific industries, languages, and regions. Masada noted that many “used the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”

The kits were also equipped with advanced evasion techniques such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations.

Masada emphasized that, while an organization or government entity may have been presented among the template offerings, it does not indicate that its systems were compromised.

However, members of the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit wrote in a blog post, “the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses.”

The importance of cyber hygiene

In nearly all observed cases, phishing lures presented “prescriptive scam red flags,” Microsoft researchers explained: Urgency and time-sensitive tasks.

They advised that users have a basic understanding of common phishing techniques and should be educated to always verify with the purported sender before clicking a link supposedly taking them to a login page, even when the task involves signing in to a known, secure account.

Beyond this, they said, sign-in prompts should clearly identify the application being authenticated to. In Microsoft Azure interactions since 2021, for example, users are prompted to “cancel” or “continue” at login, but this is often missing from phishing sign-ins, the researchers noted.

Hardening credentials and cloud identities is also necessary to defend against phishing attacks; the researchers suggested an initial step of passwordless tools like passkeys and multifactor authentication (MFA) across organizations.

“Invoke the principles of least privilege and zero trust to significantly slow down threat actors who might have been able to gain initial access and buy time for defenders to respond,” the researchers noted. These steps can help lock down global administrator roles in particular.

They also advised additional actions including the use of the Microsoft Authenticator app for passkeys and MFA; configuration of the Microsoft Defender for Office 365 Safe Links policy to apply to internal recipients; complementing MFA with conditional access policies; and only allowing MFA and passkey registrations from trusted locations and devices.