YAM Store (Threat actor): news timeline & CVEs

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.

Microsoft, Health-ISAC, and partners disrupted the CoGUI phishing kit plus related YAM Store and Iron Man fraud infrastructure, seizing domains after a civil lawsuit in the Southern District of Florida. Proofpoint says CoGUI alone generated more than 100 million malicious emails a month, while Microsoft cited more than one billion messages targeting over 75,000 organizations since January 2026. Related kits CoAceV and CoFish_Ws share roots and mainly target Japan, impersonating brands such as Amazon, Apple, PayPay, and Rakuten to steal credentials and card data. Proofpoint recorded 1,081 CoGUI campaigns and about 17,000 unique domains across the three kits.

GBHackersupdated Oct 16, 11:26 UTC · 16h agofirst Oct 16, 08:54 UTC · 19h agoPhishing & fraud in the wild 13 sources2· 1 read

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

Microsoft and partners disrupted Yam Store, a phishing service behind over one billion messages since January 2026.

Microsoft and partners, including Japanese police, disrupted Yam Store (Storm-3119), a Chinese-language phishing-as-a-service marketplace. Its CoGUI, Haozi, and Iron Man System kits, tracked as Storm-2990, sent more than one billion phishing emails and texts to over 75,000 organizations since January 2026, hitting healthcare, finance, wholesale, and IT in Japan, the US, Australia, and India. Operators reused expired domains and fake tenants to obtain Microsoft 365 and Google accounts for resale, using fake login pages, device-code phishing, and payment theft. Microsoft disabled more than 20,000 accounts and blocked over 100,000 domains.

Infosecurity Magazineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 10:00 UTC · 1d agoPhishing & fraud in the wild 13 sources2

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.

Microsoft's Digital Crimes Unit says it dismantled YAM Store, a Chinese-language phishing-as-a-service marketplace, after a nearly year-long investigation that began with a late-2025 tip from Japan's National Police Agency. The marketplace and kits including Iron Man System, CoGUI, and Haozi enabled more than 1 billion malicious messages to over 75,000 organizations, including more than 750 million sent to Microsoft customers, and generated tens of millions of dollars. Customers bought fraudulent Microsoft and Google accounts, expired-domain infrastructure, and more than 2,300 lure templates impersonating organizations in over 150 countries. Partners included Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

CSO Onlineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 01:20 UTC · 2d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.

Microsoft, Health-ISAC, Japan’s JC3, and private partners announced a court-authorized disruption of phishing kits CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. Since January 2026, operators facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations in more than 150 countries, generating tens of millions of dollars. Microsoft tracks marketplace YAM Store as Storm-3119 and the kit developers as Storm-2990; the kits were sold for cryptocurrency and used compromised or fraudulent Microsoft and Google cloud tenants, including SharePoint and OneDrive hosting. About 17,000 domains and more than 2,300 brand-impersonation templates were involved, with real-world CoGUI use since at least October 2024.

The Hacker Newsupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 17:09 UTC · 2d agoPhishing & fraud in the wild 13 sources

YAM Store

Timeline4 articles

Appears with

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages