Microsoft and Japan took down a cybercrime network behind over a billion scam messages

Microsoft and Japan took down a cybercrime network behind over a billion scam messages.

微软与日本联手捣毁了一个网络犯罪团伙，该团伙发送了超过十亿条诈骗信息。

Microsoft says it disabled over 20,000 accounts connected to a marketplace for scammers.

微软表示，已封禁了超过 20,000 个与一个诈骗者交易平台相关的账户。

We’ve all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you’ll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan’s National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man.

我们都曾收到过关于虚假停车罚单或伪造包裹投递的诈骗短信，但希望未来这类信息会减少。微软表示，它协助捣毁了一个向全球发送此类钓鱼信息的诈骗者交易平台。通过与日本警察厅的联合调查，微软将诈骗活动追溯到了一个名为“YAM Store”的平台，以及两套名为“CoGUI”和“Iron Man”的钓鱼工具包。

Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone. These messages have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.

自 2026 年 1 月以来，YAM Store、CoGUI 和 Iron Man 总共促成了超过十亿条恶意信息的发送，目标涵盖全球 75,000 多个组织，其中仅针对微软客户的信息就超过 7.5 亿条。这些信息被用于针对 150 多个国家的消费者、医疗机构、金融机构及其他企业，为运营者带来了数千万美元的非法收入。

According to Microsoft’s report, scammers could buy stolen or fraudulent Microsoft and Google accounts on YAM Store and use the phishing kits to send scam messages. Microsoft says YAM Store also hijacked real organizations’ expired web domains and created websites for nonexistent organizations, which it used to get Microsoft accounts it could resell.

根据微软的报告，诈骗者可以在 YAM Store 上购买被盗或伪造的微软和谷歌账户，并利用这些钓鱼工具包发送诈骗信息。微软称，YAM Store 还劫持了真实组织的过期域名，并为不存在的组织创建网站，以此获取可供转售的微软账户。

The Iron Man platform was also offering over 2,300 templates scammers could use to impersonate organizations like banks and police departments. Microsoft says it disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 web domains being used for impersonation and fraud. With health sector cybersecurity non-profit Health-ISAC, Microsoft also seized and redirected web domains that were powering all three platforms.

Iron Man 平台还提供了超过 2,300 个模板，供诈骗者冒充银行和警察局等机构。微软表示，已封禁了超过 20,000 个与 YAM Store 相关的账户，并屏蔽了超过 100,000 个用于冒充和欺诈的域名。此外，微软还与医疗行业网络安全非营利组织 Health-ISAC 合作，查封并重定向了支撑这三个平台运行的域名。