How Japan's Police Brought Down a Billion-Message Scam Network

The tip came from Tokyo, not Washington.

That is the detail most English-language coverage of Microsoft’s recent takedown will likely miss. The company announced on October 14 that it had seized the domains behind three Chinese-language services — CoGUI, Iron Man, and YAM Store — that together powered more than one billion fraudulent messages sent to victims in over 150 countries since January 2026. But the investigation did not begin with a US subpoena or an internal threat intel alert. It began with a Japanese government sharing data about phishing campaigns targeting Japanese users with Microsoft.

What followed was unusual in scale and structure. Microsoft obtained a court order from the US District Court for the Southern District of Florida, worked with the Health-ISAC to assess impacts on medical organizations, partnered with the cybersecurity firm Resecurity to purchase access to Iron Man, and collaborated with Japan’s National Police Agency and the Japan Cybercrime Crisis Response Center. The result was not merely the shutdown of three websites. It was the first coherent map of a commercialized cybercrime supply chain that treated fraud as a software-as-a-service business.

Fraud as a self-service platform.

The three services Microsoft dismantled performed distinct but interconnected functions. CoGUI and Iron Man were phishing-kit providers. They allowed anyone to generate fake login pages mimicking banks, government agencies, retailers, and delivery companies without writing a single line of code. Iron Man alone offered more than 2,300 templates covering organizations in over 150 countries. Resecurity’s test purchase confirmed the breadth — templates impersonating Philippine traffic authorities and Australia Post sat alongside fake Amazon pages designed specifically to harvest credentials from Japanese users.

YAM Store was the marketplace layer. It sold the inputs fraudsters needed: compromised Microsoft and Google accounts, stolen credentials, and access to dormant domains that could be resurrected to appear legitimate. The operators were buying expired domains from nonprofits and educational institutions, then registering accounts on those identities before listing the hijacked assets for sale. A buyer in Thailand could purchase a fake Microsoft 365 account, pair it with an Iron Man template impersonating a Thai bank, and launch a campaign within hours.

Microsoft estimates the three services generated tens of millions of dollars in revenue. Seven hundred fifty million of the one billion-plus fraudulent messages targeted Microsoft customers specifically. The victim organizations exceeded 75,000 across the globe. That is not a loose affiliation of individual hackers working from basements. That is an organized commercial ecosystem with product managers, customer support, and a pricing tier.

Why the Japanese angle matters.

Japan’s involvement should not be read as incidental. The National Police Agency’s initial report to Microsoft in late 2025 focused on phishing campaigns aimed at Japanese targets. JC3, Japan’s dedicated cybercrime center, aggregated intelligence from over 130 member organizations and connected cases that initially appeared as separate incidents into a single campaign pattern. Without that aggregation, the scope of the operation would have remained fragmented across national jurisdictions.

This is the structural problem that has constrained cross-border cyber enforcement for years. Fraud campaigns are global by design. The infrastructure is hosted across multiple countries, the operators communicate in encrypted channels, and the victims are distributed geographically. No single law enforcement agency has the complete picture. Microsoft’s Steven Masada stated plainly that no organization had visibility into the full scope of the criminal market before this investigation. The cooperation model — Japanese police sharing localized threat data, Microsoft correlating it with global telemetry, Health-ISAC assessing sector-specific impact, andResecurity providing operational reconnaissance — was what made the takedown possible.

What this means for platform governance.

The takedown is a victory, but it is also evidence of a recurring pattern. Cybercriminals do not need to develop infrastructure from scratch anymore. They rent it. Phishing kits, compromised accounts, and fake domains are commodities traded on dark web markets and semi-public forums. When Microsoft seized the domains and disabled over 20,000 YAM Store accounts, it removed a node in that supply chain. But the underlying demand remains. New services will emerge, often with slight variations in branding or template design. The Iron Man service itself appeared to replace CoGUI by mid-2026, suggesting a competitive market for these tools.

The deeper implication is about responsibility. Technology platforms are increasingly being asked to act as enforcers in jurisdictions where they have no legal mandate and limited political accountability. Microsoft obtained a court order, which provides some legal cover, but the company is effectively performing a function that historically belonged to law enforcement agencies coordinating across borders. The question is whether this ad hoc public-private model can scale. The current system depends on individual companies choosing to invest in global threat intelligence partnerships and willingness to pursue legal action in specific US courts. That is not a sustainable foundation for international cybercrime enforcement.

The template problem.

Microsoft was careful to note that the presence of an organization’s name in an Iron Man template does not mean that organization’s systems were compromised. The templates are generic facsimiles. A fake Australia Post page does not require a breach of Australia Post’s infrastructure. This distinction matters because it shifts the burden of defense. Organizations cannot rely on the assumption that their systems being untouched means they are safe. The threat comes from professionally produced knockoffs that are indistinguishable from the real thing to anyone who receives a single SMS about a missed delivery or an unpaid toll.

The 2,300 templates documented in Iron Man represent a quantifiable attack surface. Each template is a pre-built entry point for a social engineering campaign. The cost to a criminal is near zero — a monthly subscription to the service and a few dollars for a compromised account. The cost to defend against it is distributed across thousands of organizations, each needing to educate users, deploy email filtering, and monitor for impersonation attempts. There is no centralized defense against a product that is designed specifically to be copied.

Where this goes next.

The immediate impact of the takedown will be measurable in reduced phishing volume, at least in the short term. Microsoft has blocked over 100,000 domains associated with the operation and removed fraudulent infrastructure from its own services. But the operational model — commercialized fraud tools sold to the highest bidder — will persist. The lesson for policymakers is that the current patchwork of bilateral cooperation and company-led enforcement is insufficient. What is needed is a formalized framework for intelligence sharing between national police agencies and global technology platforms, with clear legal protocols that allow rapid domain seizure and account suspension across jurisdictions without requiring a separate court order in every case.

Japan’s National Police Agency should be credited not just for making the initial report but for aggregating disparate incidents into a pattern that revealed the larger operation. That is the model other countries should replicate. The next billion-message campaign will not wait for a Japanese tip. It will arrive from somewhere else, targeting another region, through a service with a different name. The infrastructure will look similar. The response needs to be faster.