Microsoft says it disabled 20,000-plus accounts tied to phishing marketplace

Microsoft says it disabled over 20,000 accounts connected to YAM Store, a marketplace selling accounts used for phishing, following an investigation with Japan's National Police Agency. It also blocked over 100,000 web domains used for impersonation and fraud. YAM Store and the CoGUI and Iron Man phishing kits collectively enabled more than one billion malicious messages since January 2026, targeting over 75,000 organizations worldwide, Microsoft said. Scammers bought stolen or fraudulent Microsoft and Google accounts and used the kits to send messages. Working with Health-ISAC, Microsoft also seized and redirected domains powering the three platforms. The action targeted infrastructure used against consumers, healthcare organizations and financial institutions in more than 150 countries.