Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.
Microsoft and Resecurity identified YAM Store, tracked as Storm-3119, which sold the CoGUI, Haozi, and Iron Man System phishing kits attributed collectively to Storm-2990. Since January 2026 those kits helped send more than one billion phishing emails and SMS messages targeting over 75,000 organizations in healthcare, financial services, wholesale, and IT across Japan, the United States, Australia, and India. The market also sold compromised or fraudulently obtained Microsoft and Google cloud accounts, reset passwords, assigned licenses, and turned SharePoint and OneDrive into buyer hosting; Iron Man System contained more than 2,335 templates for over 139 countries and alerted operators on Telegram. With Health-ISAC and an order from the US District Court for the Southern District of Florida, Microsoft seized supporting domains, disabled more than 20,000 accounts, and blocked more than 100,000 impersonation domains after a late-2025 referral from Japan's National Police Agency.
- YAM Store, tracked as Storm-3119, sold three phishing kits.
- Kits drove over one billion emails and texts since January 2026.
- More than 75,000 organizations across four countries were targeted.
- Operators resold compromised Microsoft and Google cloud accounts.
- A Florida court order backed seizures of domains and accounts.
Full article597 words · extracted from helpnetsecurity.com · click to collapse
Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India.
Phishing kits and cloud accounts for sale
Working with Resecurity, Microsoft identified three phishing kits sold through YAM Store, an underground marketplace that the company calls Storm-3119. Microsoft groups the developers behind CoGUI (also known as NX or FA), Haozi (also known as Phoenix) and Iron Man System under one name, Storm-2990.
The developers and operators behind these kits have helped facilitate the sending of more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
The kits provide templates that impersonate brands and organizations, allowing buyers to run phishing campaigns and steal credentials.
Sample of landing pages impersonating mainstream tech, streaming and brokerage services around the world. The templates are tailored to specific countries using trusted local or international brand names and local language. (Source: Microsoft)
YAM Store advertised CoGUI and Haozi before adding Iron Man System in June 2026. The marketplace and affiliated phishing kit businesses accepted cryptocurrency payments to help conceal their activity.
The company found that the store sold access to compromised or fraudulently obtained Microsoft and Google cloud environments, with offerings categorized by age, subscription type, and organization type, including educational institutions and nonprofits. Operators used legitimate organizations’ information to obtain cloud accounts, giving buyers low-cost access to infrastructure that appeared legitimate.
Turning stolen access into a service
Microsoft traced how YAM Store identified cloud environments, took control of accounts, and resold their resources. Operators used stolen application credentials to reset passwords, assign licenses, and maintain access. They converted compromised SharePoint and OneDrive storage into hosting services for buyers.
This application-level access helped operators retain control. Microsoft described the resulting persistence as “more durable, more scalable, and harder to detect.”
The marketplace created fake organizations to obtain cloud accounts, likely using AI-generated content and forged documents. Its storefront supported resellers and used Telegram for order notifications and communication with buyers.
Managing phishing in real time
According to technical analysis, Iron Man System contains more than 2,335 templates tailored to over 139 countries. The templates impersonate government agencies, banks, retailers, and delivery services, using local languages and brands.
They found that operators could receive Telegram notifications when victims submitted passwords, payment details, or verification codes. They could monitor each victim’s progress and manually control what appeared next.
The kits offer varying combinations of country-based access restrictions, IP address blocking, and fake CAPTCHA checks to hinder investigation. Buyers use the stolen information to access accounts and commit financial fraud.
Following the trail from Japan
The investigation began in late 2025 when Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. Investigators traced the activity to businesses selling accounts, hosting services, and phishing tools.
The company conducted test purchases to confirm how YAM Store operated. Investigators found cases in which operators acquired domains that legitimate organizations had allowed to expire, rebuilt their websites, and used those organizations’ identities to fraudulently obtain Microsoft 365 accounts for resale.
Disrupting the suppliers
Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man under an order from the US District Court for the Southern District of Florida.
They have disabled more than 20,000 accounts linked to YAM Store and was blocking more than 100,000 domains used for impersonation and fraud.
“The businesses behind it are what make it possible,” Microsoft said of the services supporting scam messages.