Microsoft Takes Down Yam Store Phishing Marketplace

Microsoft's Digital Crimes Unit and Threat Intelligence team collaborated with international partners—including Japan's National Police Agency, Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs—to dismantle the YAM Store network. The Chinese-language initial access broker operated as a commercial marketplace selling compromised Microsoft 365 and Google accounts, environment-specific credentials like .edu and .org domains, and ready-to-use phishing-as-a-service kits.

The investigation began in late 2025 after an alert from Japanese police regarding localized fraud. Using artificial intelligence tools, investigators uncovered a global infrastructure that dispatched over 1 billion malicious communications to more than 75,000 organizations, including 750 million messages targeting Microsoft customers. The illicit marketplace generated tens of millions of dollars for its operators by selling specialized kits, including CoGUI, Haozi, and the Iron Man System. Released in mid-2026, the Iron Man framework provided access to more than 2,300 templates impersonating institutions across 150 countries, paired with evasion mechanics such as geofencing, IP allowlists, and fake CAPTCHA gates.

For security practitioners, the incident highlights how low barriers to entry enable lower-skilled adversaries to execute sophisticated credential harvesting. Defensive recommendations focus on implementing zero-trust architectures and least-privilege controls to restrict administrative permissions. Organizations should deploy passwordless authentication tools like passkeys alongside multi-factor authentication registered exclusively from trusted devices. Additionally, security teams are encouraged to configure Microsoft Defender for Office 365 Safe Links policies for internal users and enforce conditional access policies to mitigate automated credential theft.