--- title: "Microsoft and Japanese police dismantle a global phishing factory" description: "Microsoft and Japan's National Police Agency announced on 14 October 2026 that they had taken down a phishing ecosystem behind more than a billion messages aimed at 75,000 organisations in 150 countries. Those unpaid-toll and stuck-parcel texts you got over the past few months may well have come from there." canonical: https://inyourgeek.com/en/articles/2026-10-15-microsoft-et-la-police-japonaise-demantelent-une-usine-a type: article author: "Sébastien Soulier" publisher: "InYourGeek" language: en datePublished: 2026-10-15 dateModified: 2026-10-15 section: "Security" tags: ["phishing", "microsoft", "cybercriminalite", "sms"] --- # Microsoft and Japanese police dismantle a global phishing factory > Microsoft and Japan's National Police Agency announced on 14 October 2026 that they had taken down a phishing ecosystem behind more than a billion messages aimed at 75,000 organisations in 150 countries. Those unpaid-toll and stuck-parcel texts you got over the past few months may well have come from there. October 15, 2026 · Security · 3 min On 14 October 2026, Microsoft published the results of an investigation carried out with Japan's National Police Agency, [reported by Bleeping Computer](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/). It started with a wave of fraud. It ended at a Chinese-language cybercrime marketplace that Microsoft tracks as YAM Store (Storm-3119). The shop did not sell phishing messages. It sold everything you need to send them: compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage space. Think of it less as a burglar and more as the hardware store that keeps a special aisle for crowbars. ## One infrastructure shop, three kits YAM Store has been linked to three phishing kits, CoGUI, Haozi and Iron Man System, grouped under the identifier Storm-2990. CoGUI initially targeted the United States and Japan. Proofpoint had already spotted email campaigns tied to this kit in late 2024, aimed at Japan and impersonating well-known Japanese companies or international organisations to steal credentials and payment details. More than 17,000 domains were used by CoGUI and two sibling kits, CoAceV and CoFish_Ws. By mid-2026, Iron Man had taken the lead. It offers more than 2,300 templates imitating banks, retailers, delivery companies and government agencies. Resecurity, which took part in the investigation, analysed a piece of infrastructure left exposed to the public: a Git and container registry with 911 published versions and eight registered accounts, plus a product-selection subsystem tied to card capture, listing 2,360 phishing packages covering 130 countries or territories, updated as recently as 1 October 2026. Software as a service, with a changelog and everything. ## Cloud accounts opened under fake identities To get hold of cloud accounts that looked legitimate, the operators bought up expired domains belonging to real organisations, rebuilt their websites so that defunct entities appeared to be alive and trading, then opened accounts in their name. The other method was to build fake organisations from scratch, content and documentation included, using AI tools. Nothing says "trust me" like a company that was born last Tuesday with a ten-year history. Inside compromised Microsoft environments, the operators used stolen application credentials to manage accounts and licences, and hijacked SharePoint and OneDrive to host their pages. Since the start of the year, more than 750 million messages have targeted Microsoft 365 customers by email and SMS, many of them through device code phishing, a technique that harvests authentication tokens. Across the whole ecosystem, the tally exceeds one billion messages, 75,000 organisations and 150 countries. ## Unpaid tolls and fake CAPTCHAs The bait is the stuff you already know: unpaid toll, traffic fine, delivery problem, account verification. The kits come with geofencing, fake CAPTCHAs and IP address filtering built in, which makes life harder for the teams trying to analyse the booby-trapped pages. Yes, even the "prove you are human" box was in on it. ## What got switched off Under an order from the federal court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected the domains propping up YAM Store, CoGUI and Iron Man. Microsoft also disabled more than 20,000 accounts linked to YAM Store and blocked 100,000 domains used for impersonation and fraud. Further pieces of infrastructure are being taken down with the Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. For your text messages, the change is real but partial. A major supplier of infrastructure and templates is down, the business model is not: these kits were sold to be redeployed by other people, and a catalogue updated on 1 October 2026 does not go out of fashion in a fortnight. Your next unpaid-toll text may no longer come from this particular shop. Nothing suggests it was the only one on the high street. ## Sources - [Global takedown hits network behind 1 billion phishing messages](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/) — bleepingcomputer.com _Article written with AI assistance from the cited sources, reviewed and approved by a human before publication._ --- Equivalent HTML page : https://inyourgeek.com/en/articles/2026-10-15-microsoft-et-la-police-japonaise-demantelent-une-usine-a Published by InYourGeek — https://inyourgeek.com/en/a-propos Method and safeguards : https://inyourgeek.com/en/methode All articles : https://inyourgeek.com/en/archives