{"id":10010,"date":"2026-10-15T01:20:18","date_gmt":"2026-10-15T01:20:18","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10010"},"modified":"2026-10-15T01:20:18","modified_gmt":"2026-10-15T01:20:18","slug":"as-phishing-as-a-service-goes-industrial-microsoft-takes-down-a-marketplace-behind-1-billion-messages","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10010","title":{"rendered":"As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages.<\/p>\n

Working with international authorities and several tech and cybersecurity companies in a nearly year-long investigation, Redmond identified and took down Yam Store, a coordinated underground network dealing in commercial phishing-as-a-service (PhaaS).<\/p>\n

The network allowed cybercriminals<\/a> to readily purchase, and very quickly deploy, pre-made kits they could use in phishing attacks to steal data and credentials.<\/p>\n

Microsoft said the takedown began as a simple investigation based on a tip from Japanese authorities.<\/p>\n

\u201cWorking together, and with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them,\u201d Steven Masada<\/a>, associate general counsel and GM for Microsoft\u2019s Digital Crimes Unit, wrote in a blog post<\/a>. \u201cWhat appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.\u201d<\/p>\n

The evolving PhaaS marketplace<\/h2>\n

Collectively, YAM Store and the kits and tools sold within it enabled the sending of more than 1 billion messages to 75,000-plus organizations worldwide. More than 750 million of those were sent to Microsoft customers alone, and ultimately generated \u201ctens of millions of dollars\u201d for criminal operators.\u00a0<\/p>\n

Investigation into the marketplace began in late 2025 after Japan\u2019s National Police Agency (NPA) notified Microsoft of \u201ca wave of fraud and scam activity\u201d targeting people and businesses in Japan. Researchers expected to find multiple individual campaigns; instead, they discovered a \u201csprawling Chinese-language cybercrime marketplace.\u201d The probe expanded globally and involved the efforts of several other law enforcement agencies, as well as companies like Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.<\/p>\n

The YAM Store served as an initial access broker (IAB), operating much like an online marketplace; in this case, the merchandise was fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams like credential and data theft. Customers could browse, compare prices, and make purchases. Available tools were arranged based on age and subscription and environment types (like .edu or .org sites).<\/p>\n

In some cases, criminal operators were able to register internet domains that legitimate organizations had allowed to expire, then rebuilt them to appear active. They targeted specific sectors (like non-profits or education) to fraudulently obtain Microsoft 365 accounts to later sell through the YAM store.<\/p>\n

The researchers discovered that the YAM Store evolved as different kits became available, and identified three popular PhaaS kits: Iron Man System, CoGUI, and Haozi.<\/p>\n

The newer Iron Man system came to the fore in mid-2026. It provided pre-built lure pages capturing any victim-submitted data. The lure sites impersonated healthcare providers, police departments, government agencies, postal and courier services, toll and transportation authorities, tax agencies, banks, telecoms, and retailers. Through test purchases and intelligence work, investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.<\/p>\n

Iron Man effectively expanded the PhaaS model by giving criminals access to thousands of ready-made templates tailored to specific industries, languages, and regions. Masada noted that many \u201cused the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.\u201d<\/p>\n

The kits were also equipped with advanced evasion techniques such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations.<\/p>\n

Masada emphasized that, while an organization or government entity may have been presented among the template offerings, it does not indicate that its systems were compromised.<\/p>\n

However, members of the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit wrote in a blog post<\/a>, \u201cthe scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses.\u201d<\/p>\n

The importance of cyber hygiene<\/h2>\n

In nearly all observed cases, phishing<\/a> lures presented \u201cprescriptive scam red flags,\u201d Microsoft researchers explained: Urgency and time-sensitive tasks.<\/p>\n

They advised that users have a basic understanding of common phishing techniques and should be educated to always verify with the purported sender before clicking a link supposedly taking them to a login page, even when the task involves signing in to a known, secure account.<\/p>\n

Beyond this, they said, sign-in prompts should clearly identify the application being authenticated to. In Microsoft Azure interactions since 2021, for example, users are prompted to \u201ccancel\u201d or \u201ccontinue\u201d at login, but this is often missing from phishing sign-ins, the researchers noted.<\/p>\n

Hardening credentials and cloud identities is also necessary to defend against phishing attacks; the researchers suggested an initial step of passwordless tools like passkeys and multifactor authentication (MFA) across organizations.<\/p>\n

\u201cInvoke the principles of least privilege and zero trust to significantly slow down threat actors who might have been able to gain initial access and buy time for defenders to respond,\u201d the researchers noted. These steps can help lock down global administrator roles in particular.<\/p>\n

They also advised additional actions including the use of the Microsoft Authenticator app for passkeys and MFA; configuration of the Microsoft Defender for Office 365 Safe Links policy to apply to internal recipients; complementing MFA with conditional access policies; and only allowing MFA and passkey registrations from trusted locations and devices.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages. Working with international authorities and several tech and cybersecurity companies in a nearly year-long investigation, Redmond identified and took down Yam Store, a coordinated underground network dealing in commercial phishing-as-a-service (PhaaS). The network allowed cybercriminals to readily purchase, and very quickly […]<\/p>\n","protected":false},"author":0,"featured_media":10011,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10010","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10010"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10010"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10010\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10011"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}