Microsoft and Japanese police dismantle global phishing network

The Japanese National Police Agency and Microsoft have successfully dismantled a transnational cybercrime network responsible for massive phishing operations. The crackdown targeted the YAM Store trading platform and two phishing toolkits known as CoGUI and Iron Man.

Since January 2026, these entities launched over 1 billion malicious messages targeting more than 75,000 organizations globally, including consumers, medical institutions, and financial entities across 150 countries. The operations generated tens of millions of dollars in illegal revenue. Specifically, the toolkits allowed scammers to purchase stolen or forged Microsoft and Google accounts and use over 2,300 templates to impersonate banks or police departments.

In Japan, the National Police Agency noted that approximately half of the 120,000 fraudulent websites targeting Japanese companies identified in 2025 were created using these specific kits. In response, Microsoft has banned over 20,000 associated accounts and intercepted more than 100,000 fraudulent domains. Working with the non-profit Health-ISAC, Microsoft has also taken control of and redirected the domains supporting these criminal platforms.