Why scam texts look so real: inside the phishing kits Microsoft just took down

Ever received a text saying you owe a small road toll, a parcel is waiting for a customs fee, or a tax refund is ready? The page behind the link usually looks exactly like the real postal service, tax office or bank. That is not because each criminal is a skilled web designer. They buy the whole thing ready-made.

What Microsoft took down

On 14 October 2026 Microsoft announced that it had used a US court order to seize domains used by three Chinese-language crime platforms, working with Japan's National Police Agency, the health-sector security group Health-ISAC, the security firm Resecurity and other partners:

• YAM Store, a marketplace selling stolen and fake cloud accounts and domains, including stolen Microsoft 365 logins, which criminals used to send messages and host fake pages.
• CoGUI, which sold ready-made fake websites and messages copying brands, banks and government agencies, heavily used against people in Japan.
• Iron Man, a "phishing kit as a service" with more than 2,300 ready-made fake pages for postal services, traffic-fine offices, tax agencies, banks and phone companies in many countries.

Microsoft said the platforms were used to impersonate more than 75,000 organisations in over 150 countries, and it disabled more than 20,000 linked accounts.

Crime as a subscription service

Modern scams run like a business with suppliers:

1. One group sells the kit: the fake page, the text wording and a control panel.
2. Another sells accounts and domains to host it and send messages.
3. Others sell phone number lists and sending services.
4. The "customer" only has to pick a country and a brand, then wait for victims to type their card details or one-time codes.

That is why the same toll or parcel text appears in so many countries with only the logo changed, and why scams appear within hours of a real news event.

How to stay ahead of it

• Never pay from a link in a text, however small the amount. A small fee is the bait; the goal is your full card details or the code your bank sends.
• Go the long way round. Open the official app or type the website yourself to check for fines, parcels or refunds.
• Look at the address, not the logo. Logos are copied perfectly; the web address is where fakes usually give themselves away. See phishing basics.
• Never share a one-time code sent by your bank. No genuine company will ask you to read it back.
• Report and delete. In the UK forward scam texts to 7726; many other countries have similar services, and phones have a "report junk" option.

For IT and security teams

The YAM Store side of this story is a reminder that stolen work accounts are a product. Enforce MFA on Microsoft 365 and Google Workspace, alert on sign-ins from unusual places, and review which apps and mailbox rules users have created. A compromised staff mailbox can become someone else's scam engine overnight.

For this month's other warnings, read our October 2026 scam alerts.

Sources

• The Record: Microsoft takes down 3 major Chinese phishing platforms
• SecurityWeek: Microsoft disrupts Chinese-language phishing market behind 1B messages
• Infosecurity Magazine: Microsoft disrupts global YAM Store network