Microsoft seized the domains associated with criminal infrastructure used to send fraudulent messages under a court order. The investigation was prompted by information provided by Japan's National Police Agency.
Microsoft announced on 14 October US time that it had seized domains associated with certain services used to send fraudulent messages around the world. The targets were 3 services, CoGUI, Iron Man and YAM Store, which were used to sell fake website creation tools and fraudulent accounts in the Chinese-language cybercrime market.
The investigation was prompted by information provided by Japan's National Police Agency, which revealed the existence of large-scale criminal infrastructure behind the fraud campaigns. Microsoft worked with Health-ISAC and other partner organizations to seize the related domains under a court order, while also deactivating more than 20,000 accounts associated with YAM Store.
According to Microsoft, the 3 services had been used since 2026 to send more than 1 billion fraudulent messages in total worldwide, including more than 750 million targeting the company's customers. More than 75,000 organizations in over 150 countries were affected, and the operators allegedly generated tens of millions of dollars in revenue.
The measures are expected to curb part of the infrastructure supporting the fraud and the account supply network, and Microsoft said it would continue removing related infrastructure.