Microsoft and Japan's National Police Agency just shut down a marketplace that powered one of the biggest phishing operations most people never heard of.
The target was YAM Store, a marketplace that sold access to two phishing kits called CoGUI and Iron Man. Since January 2026, the operation behind them sent more than a billion malicious messages to over 75,000 organizations worldwide, including over 750 million messages aimed at a single target base, according to Microsoft. The messages mimicked the kind of scam texts that have become background noise for most phone users: fake parking tickets, fake package deliveries, fake account alerts. Microsoft and Japanese police traced the activity back to the marketplace and kits, then moved to dismantle the infrastructure.
This matters less for the takedown itself and more for what it confirms: consumer phishing has become an actual supply chain, with off-the-shelf kits and marketplaces doing the work that used to require technical skill. CoGUI and Iron Man effectively let low-skill operators run high-volume scam campaigns, the same commoditization pattern security researchers have flagged in ransomware-as-a-service for years.
One marketplace going dark will not stop the next one from opening. Scam-kit infrastructure has proven replaceable before, and there is nothing here suggesting the people running YAM Store were arrested, only that the store and its kits were taken offline.