Microsoft has dismantled Yam Store, a criminal marketplace behind more than 1 billion malicious messages sent to over 75,000 organizations worldwide — an operation that netted its operators "tens of millions of dollars" and redefined how cheaply phishing at scale can be bought.

The takedown, announced October 14, capped a nearly year-long investigation that began with a tip from Japan's National Police Agency in late 2025. Redmond worked alongside international law enforcement and private-sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs to map and take down what researchers describe as a "sprawling Chinese-language cybercrime marketplace."

Investigators expected to find scattered, individual scam campaigns. Instead, they found an industrial supply chain.

What was Yam Store selling?

Yam Store operated as an initial access broker (IAB) — functionally, an e-commerce site where the merchandise was fraudulent Microsoft and Google accounts and ready-made phishing tools. Customers could browse, compare prices, and check out. Listings were sorted by account age, subscription type, and environment — .edu or .org domains carried their own price tiers.

In some cases, criminals registered internet domains that legitimate organizations had let expire, rebuilt them to look active, and targeted sectors such as non-profits and education to fraudulently obtain Microsoft 365 accounts for resale.

"What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation," said Steven Masada, associate general counsel and GM of Microsoft's Digital Crimes Unit.

Microsoft's own customers absorbed more than 750 million of the billion-plus messages.

How industrial did the kits get?

Researchers tracked three dominant PhaaS kits moving through the marketplace: Iron Man System, CoGUI, and Haozi. Iron Man, which emerged in mid-2026, was the most alarming. It shipped pre-built lure pages that captured any victim-submitted data, impersonating:

• Healthcare providers and police departments
• Government agencies and tax authorities
• Postal, courier, toll, and transportation services
• Banks, telecoms, and retailers

Through test purchases and intelligence work, investigators catalogued more than 2,300 templates impersonating organizations across more than 150 countries. That's not one scam — it's a catalog, indexed by industry, language, and region.

Many templates, Masada said, "used the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data."

The kits also carried professional-grade evasion: geofencing, fake CAPTCHA gates, IP blocklists and allowlists, and anti-detection configurations. Microsoft noted that an organization appearing among the templates doesn't mean its systems were compromised — only that its brand was being weaponized.

As Microsoft Threat Intelligence and Digital Crimes Unit researchers put it, "the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale."

What does this change for security teams?

The takedown disrupts supply, not demand. PhaaS marketplaces rebuild, and the defensive posture Microsoft outlines is unglamorous but concrete.

In nearly all observed cases, phishing lures carried "prescriptive scam red flags" — urgency and time-sensitive tasks top the list. Users should verify with the purported sender before clicking any link to a login page, even for known, secure accounts.

On the identity side, Microsoft recommends:

• Passwordless tools and MFA across the organization, via Microsoft Authenticator
• Conditional access policies complementing MFA
• MFA and passkey registrations restricted to trusted locations and devices only
• Defender for Office 365 Safe Links policy extended to internal recipients
• Least privilege and zero trust to slow attackers who do gain a foothold

One specific tell: since 2021, Microsoft Azure login prompts ask users to "cancel" or "continue." Phishing sign-ins often omit this. Sign-in prompts should clearly identify the application being authenticated to — when they don't, that absence is itself a signal.

The connective thread in Microsoft's account is that AI tools helped link accounts, websites, and infrastructure that initially looked unrelated. "Working together, and with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them," Masada wrote.

A billion messages, 75,000 targets, thousands of templates — and a checkout cart.