Microsoft's Digital Crimes Unit dismantled YAM Store, a commercial phishing-as-a-service marketplace that enabled more than 1 billion malicious messages aimed at over 75,000 organizations worldwide. The action followed a nearly year-long investigation that began in late 2025, when Japan's National Police Agency flagged a wave of fraud and scam activity hitting people and businesses in Japan. What investigators expected to be a handful of separate campaigns turned out to be a sprawling Chinese-language cybercrime marketplace, mapped with the help of AI-assisted analysis and partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. The activity described here was documented by CSO Online.

More than 750 million of those 1 billion messages were sent to Microsoft customers, generating "tens of millions of dollars" for the operators, according to Microsoft.

Phishing-as-a-service means criminals no longer build anything. They buy. YAM Store operated as an initial access broker with a storefront experience: browse, compare prices, purchase. The merchandise was fraudulent Microsoft and Google accounts plus ready-made kits, sorted by account age, subscription level, and environment type such as .edu or .org domains. Operators also re-registered internet domains that legitimate organizations had allowed to expire, rebuilt them to look active, and used them to fraudulently obtain Microsoft 365 accounts for resale. If your firm has let an old marketing or project domain lapse, that name has resale value to someone.

The volume is the point here. This is commodity phishing arriving in the inbox of your accounts payable clerk, your paralegal, your front-desk staff, sent by operators who bought a kit rather than developed tradecraft. Microsoft Threat Intelligence noted that readily available criminal infrastructure lowers the barrier to entry, letting less skilled actors target organizations at scale and add to fraud losses. Microsoft also clarified a point to pass along to clients: an organization appearing among the marketplace's impersonation templates does not mean that organization's systems were breached.

How YAM Store Packaged Phishing Kits for Paying Customers

The YAM Store ran as a storefront, not a closed crew. Customers browsed inventory, compared prices, and bought what they needed, and the merchandise was fraudulent Microsoft and Google accounts alongside ready-made attack tooling for credential and data theft.

Listings were sorted by account age, subscription type, and environment type, including .edu and .org tenants. That segmentation matters operationally: an aged account inside an education or nonprofit tenant carries sending reputation that a freshly registered domain does not, so mail from it lands in inboxes that would otherwise filter it. A buyer picking inventory by domain suffix is choosing which of your trust assumptions to borrow.

Supply came from two directions. Operators registered internet domains that legitimate organizations had allowed to expire, then rebuilt them to look active, which maps to MITRE ATT&CK T1583.001 (Acquire Infrastructure: Domains). They also targeted specific sectors, nonprofits and education among them, to fraudulently obtain Microsoft 365 accounts that were then resold through the marketplace (T1585.003, Establish Accounts: Cloud Accounts).

Three kits defined the catalog over its life: CoGUI, Haozi, and the newer Iron Man System, which came to the fore in mid-2026. Microsoft's account describes Iron Man in the most detail. It shipped pre-built lure pages that captured any data a victim submitted, so an affiliate never had to build a fraudulent site, register it, or write the capture logic.

Investigators counted more than 2,300 templates impersonating organizations across more than 150 countries, obtained partly through test purchases. The impersonated brands clustered around institutions people already expect to hear from unprompted:

• Healthcare providers, police departments, and government agencies
• Postal and courier services, toll and transportation authorities
• Tax agencies, banks, telecoms, and retailers

Steven Masada noted that many of these pages "used the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information." Templates were tailored to specific industries, languages, and regions, which is why a single kit purchase supports campaigns in markets the buyer has never operated in.

The kits also carried an anti-analysis layer: geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations. Geofencing and IP filtering function as execution guardrails (T1480), serving the real lure only to visitors matching the targeted region while showing everything else a benign page or nothing at all. For your security team, that means a reported URL may render clean when an analyst opens it from a corporate egress IP or a sandbox, and the fake CAPTCHA gate blocks automated crawlers from ever reaching the credential form.

Two points of precision are worth holding onto. Microsoft's published material does not describe Telegram support channels, panel URL paths, hosting providers, or adversary-in-the-middle session token or MFA interception for these kits, so treat any such claim as inference rather than confirmed reporting. Masada also stated plainly that an organization appearing among the template offerings does not indicate its systems were compromised.

The commercial result was "tens of millions of dollars" for the operators. Microsoft Threat Intelligence and the Digital Crimes Unit framed the consequence directly: readily available criminal infrastructure lowers the barrier to entry, letting less skilled criminals target organizations at scale and contributing to fraud losses.

Business Exposure from Credential Theft at This Scale

The YAM Store worked as an initial access broker, which means the credentials your staff type into a fake login page are not the end of the attack. They are inventory. Once a working Microsoft 365 or Google account is for sale, the buyer decides what happens next, and that buyer may be running invoice fraud this month and selling the same access to a ransomware affiliate the next.

For your finance team, this shows up as business email compromise. An attacker sitting inside a real mailbox reads your billing threads, learns your vendor names and payment cycles, then sends a change-of-bank-details request from the address your accounts payable clerk already trusts. Payroll diversion follows the same pattern, with an employee's direct deposit details quietly updated through a self-service HR portal using the stolen single sign-on credential.

These transactions clear because they are authorized by a legitimate account. Your bank sees a valid instruction, your vendor sees a normal email, and recovery depends on how quickly someone notices the money went to the wrong place.

The consumer side of the damage lands on your brand. Iron Man shipped more than 2,300 ready-made templates impersonating organizations across more than 150 countries, covering healthcare providers, police departments, tax agencies, postal and courier services, toll and transport authorities, banks, telecoms, and retailers. If your company's login page is among those templates, your customers are handing over passwords and payment card details on a page that carries your logo.

Microsoft's Steven Masada was clear that appearing in the template catalog does not mean an organization's systems were breached. Your customers will not draw that distinction. The support calls, the chargebacks, and the questions about whether your site is safe arrive either way, and they arrive without any alert from your own security tooling, because nothing in your environment was touched.

The resale dimension is what turns a single phished password into a larger incident. Access brokered through this ecosystem is exactly the entry point ransomware operators buy rather than build, and the gap between the phishing click and the encryption event can run weeks. During that window your logs look ordinary, because the intruder is signing in as a real person.

Where stolen credentials expose customer or employee personal data, you inherit notification duties under whichever privacy regimes apply to you. That typically means:

• Determining what data a compromised mailbox or account could reach, which is often slower and more expensive than the containment itself
• Notifying regulators and affected individuals within statutory deadlines you do not control
• Answering contractual breach-notification clauses owed to enterprise customers and partners
• Funding forensic work to prove scope, since "we think only one account was involved" is rarely accepted on assertion

Treat the takedown as disruption, not removal. The marketplace generated tens of millions of dollars for its operators, and that revenue does not vanish because one storefront closed. Kits like CoGUI and Haozi predate the newer tooling and the affiliates who used them are commercial customers, so they migrate to whichever competing service is still selling.

The evasion features built into these kits, including geofencing, fake CAPTCHA gates, and IP allowlists and blocklists, exist so that your security team and your email filters see a blank page while your employee in the targeted region sees a convincing login screen. That asymmetry is why these campaigns reach inboxes and why victims often report the problem before your tooling does.

Detection and Response Actions for YAM Store-Style Phishing

The first action after a suspected credential-capture event is session revocation, not just a password reset. The lure pages sold through these kits record whatever the victim types, and an active sign-in session can remain usable after the password changes. Revoke refresh tokens for any account that submitted data to a flagged page, then force a reset and re-register multifactor methods from a known device.

While you do that, pull authentication logs for the affected users and look for sign-ins from unexpected regions, repeated MFA prompts, and session activity continuing from an IP the user never authenticates from. In environments Capstone manages, Adlumin ITDR watches authentication behavior across managed environments and surfaces these patterns as identity alerts rather than leaving them buried in raw sign-in logs.

Be careful how your team validates suspicious links. The kits shipped with geofencing, IP blocklists and allowlists, fake CAPTCHA gates, and anti-detection configurations, so an analyst opening the URL from a corporate range or a sandbox may be served a harmless page while the targeted user sees the full credential form. Treat a clean sandbox verdict as inconclusive and confirm through the sign-in logs instead.

Teach users the one checkpoint that the operators of these kits consistently failed to copy. Genuine Azure sign-in prompts have identified the application being authenticated to and offered a cancel or continue choice since 2021, and phishing sign-in pages routinely omit it. Microsoft researchers also noted that nearly every lure relied on urgency and a time-sensitive task, so a message pushing immediate action toward a login page deserves a call to the sender before anyone types a password.

Over the next few weeks, move the controls that stop credential capture from paying off:

• Roll out passkeys and the Microsoft Authenticator app so the credential a user could hand over no longer exists in a reusable form.
• Restrict MFA and passkey registration to trusted locations and devices, which blocks an attacker from enrolling their own authenticator on an account they just compromised.
• Pair MFA with conditional access policies that treat unmanaged and unenrolled devices differently from corporate hardware.
• Configure the Defender for Office 365 Safe Links policy to apply to internal recipients, so lures forwarded from an already-compromised internal mailbox are rewritten and checked.
• Apply least privilege and zero trust principles to global administrator roles, keeping the number of standing admins small and separate from daily-use accounts.

Microsoft's own framing is that these steps slow an intruder who already has initial access and buy defenders time to respond, which is the realistic goal when the attacker holds valid credentials.

For the longer horizon, three items belong on your roadmap. Enforce DMARC on your sending domains so impersonation of your brand in mail fails authentication at the recipient. Audit mailbox rules on a schedule, since auto-forward and auto-delete rules are the usual way an intruder hides replies inside a mailbox they control. Finally, inventory domains your organization has let lapse, because operators behind these kits re-registered expired domains belonging to legitimate organizations and rebuilt them to look active.

Run a tabletop exercise built on mass credential compromise, where the trigger is dozens of staff submitting passwords to the same page in one morning. The questions to answer in advance are who authorizes a bulk token revocation, how quickly you can do it, and what business processes break while it runs.

What Comes After the Takedown

The marketplace ran on more than one product line. Microsoft's investigators identified three popular kits moving through it: Iron Man System, CoGUI, and Haozi, with Iron Man coming to the fore in mid-2026. A storefront that already cycled through multiple kit vendors does not depend on any one of them, and the operators who bought access there have other places to shop.

That is the practical takeaway for your planning. Taking the storefront offline removes a distribution channel and the revenue attached to it, which the researchers put at tens of millions of dollars, but it does not remove the technique or the people buying it. The same evasion features sold with these kits, including geofencing, fake CAPTCHA gates, and IP allowlists and blocklists that hide the lure page from anything that looks like a security scanner, will appear in whatever replaces them. Your inbound mail volume and the quality of the lures your staff see are unlikely to change much.

Scale is part of why. Test purchases turned up over 2,300 templates impersonating organizations across more than 150 countries, covering tax agencies, banks, postal and courier services, telecoms, and police departments. If your brand or a vendor you work with appeared in that catalog, Microsoft has been clear it says nothing about whether those systems were compromised.

The single action that changes your exposure is moving high-value and privileged accounts to phishing-resistant authentication, meaning passkeys rather than passwords plus a one-time code. A credential typed into a convincing replica of your login page stops being sellable inventory when the credential alone cannot complete a sign-in.