# Microsoft says it disabled 20,000-plus accounts tied to phishing marketplace

_Published Wednesday, October 14, 2026 at 5:15 PM EDT · Security · Latest · Tier 2 — Notable_

![A smartphone sits on top of a surface with red tape reading “DANGER.” Where one strip intersects the phone, it continues inside the phone’s screen. — Primary](https://platform.theverge.com/wp-content/uploads/sites/2/chorus/uploads/chorus_asset/file/23318439/akrales_220309_4977_0324.jpg?quality=90&strip=all&crop=0%2C10.732984293194%2C100%2C78.534031413613&w=1200)

Microsoft says it disabled over 20,000 accounts connected to YAM Store, a marketplace selling accounts used for phishing, following an investigation with Japan's National Police Agency. It also blocked over 100,000 web domains used for impersonation and fraud.

YAM Store and the CoGUI and Iron Man phishing kits collectively enabled more than one billion malicious messages since January 2026, targeting over 75,000 organizations worldwide, Microsoft said. Scammers bought stolen or fraudulent Microsoft and Google accounts and used the kits to send messages. Working with Health-ISAC, Microsoft also seized and redirected domains powering the three platforms. The action targeted infrastructure used against consumers, healthcare organizations and financial institutions in more than 150 countries.

## Sources

- [The Verge](https://www.theverge.com/tech/1011487/microsoft-scam-messages-marketplace-takedown)

---
Canonical: https://techandbusiness.org/newswire/3_WvPcFTp3CkJEyYksb3r0
Published: 2026-10-14T21:15:46.755Z
Story chronology: 2026-10-14T20:03:43.000Z
Retrieved: 2026-10-14T23:42:11.559Z
Publisher: Tech & Business (techandbusiness.org)