# How a Global Cybercrime Marketplace Was Shut Down After Sending Over 1 Billion Scam Messages
Cybercriminals have long relied on phishing to steal credentials, passwords, and financial data from individuals and organizations worldwide. In a landmark operation, law enforcement agencies and major technology companies joined forces to dismantle a massive underground network that had been powering large-scale phishing attacks across the globe.
## What Was the Operation?
Authorities recently took down a coordinated criminal network known as the Yam Store, which operated as a commercial phishing-as-a-service platform. The marketplace allowed cybercriminals to purchase pre-built phishing kits and deploy them almost immediately to carry out scams. These kits included ready-made web pages, stolen account credentials, and tools designed to impersonate trusted organizations.
The operation came together after Japanese authorities flagged a spike in fraud and scam activity targeting businesses and individuals in Japan. What investigators initially expected to be a handful of separate campaigns turned out to be a vast, interconnected criminal ecosystem. The probe eventually expanded internationally, bringing together law enforcement from multiple countries alongside cybersecurity firms including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
## The Scale of the Threat
The Yam Store and the tools sold through it were responsible for sending more than one billion malicious messages to over 75,000 organizations worldwide. More than 750 million of those messages were directed at customers of one major technology company. The criminal operators behind the network generated tens of millions of dollars in revenue from their operations.
The marketplace functioned much like a legitimate e-commerce platform. Customers could browse listings, compare prices, and purchase fraudulent accounts or phishing tools. The offerings were organized by account type, subscription level, and the type of organization the account belonged to — including educational institutions and nonprofit organizations.
In some cases, criminals would let domain registrations lapse on websites belonging to real organizations, then rebuild those domains to look active again. This tactic allowed them to create seemingly legitimate accounts that could later be sold through the marketplace.
## The Phishing Kits at the Center of It All
Investigators identified three particularly popular phishing kits circulating through the network: Iron Man System, CoGUI, and Haozi.
The most recent of these, Iron Man System, emerged in mid-2026 and quickly became the go-to tool for criminals. It provided users with thousands of pre-built phishing pages designed to capture any data submitted by victims. These pages were crafted to impersonate a wide range of trusted entities, including:
– Healthcare providers
– Police departments and government agencies
– Postal and courier services
– Banks and financial institutions
– Telecom companies
– Retailers and transportation authorities
Through careful investigation, researchers found more than 2,300 unique phishing templates representing organizations across more than 150 countries. The templates were tailored to specific industries, languages, and regions, making the scams more convincing and harder to detect.
The kits also included sophisticated evasion techniques such as geofencing, fake CAPTCHA challenges, IP address filtering, and anti-detection settings — all designed to avoid being flagged by security software.
It is important to note that while many real organizations appeared as templates in the phishing kits, this did not mean those organizations had been directly compromised. The criminals were simply using the appearance of trusted brands to make their scams more believable.
## Why Phishing Is Getting Easier for Criminals
The sheer availability of these ready-made tools has significantly lowered the barrier to entry for cybercrime. Even individuals with limited technical skills can now launch large-scale phishing campaigns by purchasing a kit and sending out messages. This has created an ecosystem where fraud can be scaled rapidly and cheaply.
As experts involved in the investigation noted, a single scam message may look simple on the surface, but it is often just the visible end of a much larger transnational operation with infrastructure spread across multiple countries.
## How to Protect Yourself
Security researchers emphasized the importance of basic cyber hygiene in defending against these types of attacks. In nearly every case observed, the phishing messages shared common red flags:
– A sense of urgency or time pressure
– Requests to act immediately on a task
– Links directing users to login pages
Experts recommend that users always verify the authenticity of any message requesting login credentials by contacting the purported sender directly through a known, trusted channel. Additionally, sign-in prompts should clearly identify the application or service being accessed. In legitimate login experiences, users should see clear options to cancel or continue, whereas phishing pages often lack these indicators.
Organizations should also take proactive steps to strengthen their defenses. Recommended measures include:
– Implementing passwordless authentication tools like passkeys
– Requiring multi-factor authentication (MFA) across all accounts
– Using the principle of least privilege to limit access to sensitive systems
– Applying zero-trust security models to slow down attackers who gain initial access
– Configuring email security policies to protect internal recipients
– Restricting MFA and passkey registrations to trusted locations and devices
## FAQ
**What is phishing-as-a-service (PhaaS)?**
PhaaS refers to criminal platforms that sell ready-made phishing tools and templates to other cybercriminals. These services lower the technical barrier to entry, allowing even novice criminals to launch convincing phishing campaigns.
**How did investigators discover the Yam Store?**
The investigation began after Japanese law enforcement alerted Microsoft to a surge in fraud and scam activity in Japan. Researchers then uncovered a broader Chinese-language cybercrime marketplace operating internationally.
**Were any legitimate organizations hacked as part of this scheme?**
No. While the phishing templates impersonated real organizations, researchers confirmed that the organizations themselves were not compromised. Criminals used these brands to make their scams appear more trustworthy.
**What can individuals do to stay safe from phishing attacks?**
Individuals should remain skeptical of urgent or pressure-filled messages, avoid clicking suspicious links, verify requests through trusted contact channels, and enable multi-factor authentication on all accounts.
**What role did artificial intelligence play in the investigation?**
AI tools helped investigators connect accounts, websites, and infrastructure that initially appeared unrelated, allowing them to map out the full scope of the criminal network.
## Conclusion
The dismantling of the Yam Store demonstrates the power of collaboration between governments, law enforcement, and the private technology sector in combating cybercrime. While the takedown removes a significant criminal resource from the internet, the fight against phishing and online fraud is ongoing. Staying informed, practicing good cyber hygiene, and adopting stronger authentication methods remain essential for individuals and organizations alike. Cybercriminals will continue to adapt their tactics, but vigilance and proactive security measures can go a long way in reducing the risk of falling victim to their schemes.
Thank you for reading
