Microsoft announced on October 15, 2026, that it had disrupted YAM Store, a phishing-as-a-service network responsible for sending more than 1 billion malicious messages. The criminal marketplace sold phishing kits and compromised cloud accounts, enabling fraud and credential theft campaigns worldwide.
The takedown followed a nearly year-long investigation involving cybersecurity firm Resecurity and international authorities, including a tip from Japan’s National Police Agency. After obtaining a court order, Microsoft dismantled infrastructure used to impersonate well-known brands and target more than 75,000 organizations.
The operation disabled more than 20,000 malicious accounts. It also blocked more than 100,000 fraudulent domains.