Microsoft disrupts YAM Store phishing market behind 1 billion messages

Microsoft and partners seized YAM Store and related phishing kits linked to more than one billion messages since January 2026; sources disagree on reach and domain totals.

Microsoft, Health-ISAC, Japanese authorities including the National Police Agency and JC3, and companies including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs disrupted the Chinese-language marketplace YAM Store (also Yam Store, tracked as Storm-3119) and the phishing kits CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System, tracked collectively as Storm-2990. Under a civil action and order from the US District Court for the Southern District of Florida, Microsoft seized and redirected supporting domains, disabled more than 20,000 accounts, and said it is blocking more than 100,000 impersonation domains. Since January 2026 the services are linked to more than one billion phishing emails and text messages sent to more than 75,000 organizations, with over 750 million—or, in CyberScoop’s wording, more than three-quarters—aimed at Microsoft customers; The Hacker News and CSO Online said the activity generated tens of millions of dollars. Sources disagree on geography, describing either more than 150 countries or a focus on Japan, the United States, Australia, and India, and they split Iron Man’s catalog between about 2,335 templates in 139 countries and about 2,360 in 130, while others cite more than 2,300 templates. The marketplace resold compromised or fraudulent Microsoft and Google cloud accounts, licenses, and storage, and campaigns used expired domains and SharePoint and OneDrive hosting against healthcare, finance, wholesale or logistics, and IT targets. Later Proofpoint reporting adds related kits CoAceV and CoFish_Ws, says CoGUI exceeded 100 million malicious emails a month, and counts about 17,000 domains—far below Microsoft’s blocking figure—while naming 66 impersonated brands, especially Japanese banks and retailers.

• On Oct. 14, 2026, Microsoft and Health-ISAC, under a US District Court for the Southern District of Florida order, seized and redirected domains used by YAM Store (also Yam Store, Storm-3119) and kits CoGUI, Haozi, and Iron Man System…
• Since January 2026 the ecosystem is linked to more than one billion phishing emails and SMS messages sent to more than 75,000 organizations, including over 750 million aimed at Microsoft customers; CyberScoop instead said more than…
• Microsoft disabled more than 20,000 related accounts and said it is blocking more than 100,000 impersonation domains.
• Sources disagree on reach and catalog size: more than 150 countries versus a focus on Japan, the United States, Australia, and India, and Iron Man figures of about 2,335 templates in 139 countries versus about 2,360 in 130, or more than…
• The Hacker News and CSO Online said the activity generated tens of millions of dollars; CSO said the nearly year-long probe began with a late-2025 tip from Japan’s National Police Agency.
• Proofpoint says CoGUI alone exceeded 100 million malicious emails a month and, with related kits CoAceV and CoFish_Ws, used about 17,000 domains—13,586 CoGUI, 2,812 CoAceV, and 191 CoFish_Ws—plus 3,788 unique FQDNs from July 1 to Sept. 17,…