YAM Store: phishing network behind 1 billion scam messages disrupted
Reported: YAM Store (with CoGUI and Iron Man phishing kits) YAMST (Other)
Compiled by ScamMarketCap from public recordsHappened Oct 14, 2026United States
- —
- No amount stated
Reported: YAM Store (with CoGUI and Iron Man phishing kits) YAMST (Other)
Compiled by ScamMarketCap from public recordsHappened Oct 14, 2026United States
On October 14, 2026, Microsoft said that, following a tip from Japan's National Police Agency, it had moved to dismantle YAM Store, a Chinese-language marketplace that sold compromised Microsoft and Google accounts and other tools for scam campaigns, along with the CoGUI and Iron Man phishing kits. Since January 2026 the services had enabled more than 1 billion malicious emails and text messages in over 150 countries, aimed at consumers and at more than 75,000 organizations. The messages used lures such as unpaid tolls, traffic fines and undelivered parcels, and Iron Man alone offered over 2,300 templates impersonating banks, retailers, delivery services, police and government agencies. Microsoft said CoGUI was used particularly against victims in Japan and the United States.
Under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that ran the services. Microsoft also disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. The announcement did not name the operators or report any arrests.
This case file is compiled from public records and established reporting. Status as of the last update, Nov 3, 2026.
Case files summarize court records, regulator actions and established reporting.
Did this happen to you too? Share what you know: dates, amounts, names used, websites and wallet addresses.
to comment. It takes one email.
Case files summarize court records, regulator actions and established reporting.
Sign in to add yourself. Only the totals are public.
Comments
Did this happen to you too? Share what you know: dates, amounts, names used, websites and wallet addresses.