Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India.
Phishing kits and cloud accounts for sale
Working with Resecurity, Microsoft identified three phishing kits sold through YAM Store, an underground marketplace that the company calls Storm-3119. Microsoft groups the developers behind CoGUI (also known as NX or FA), Haozi (also known as Phoenix) and Iron Man System under one name, Storm-2990.
The developers and operators behind these kits have helped facilitate the sending of more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
The kits provide templates that impersonate brands and organizations, allowing buyers to run phishing campaigns and steal credentials.
Sample of landing pages impersonating mainstream tech, streaming and brokerage services around the world. The templates are tailored to specific countries using trusted local or international brand names and local language. (Source: Microsoft)
YAM Store advertised CoGUI and Haozi before adding Iron Man System in June 2026. The marketplace and affiliated phishing kit businesses accepted cryptocurrency payments to help conceal their activity.
The company found that the store sold access to compromised or fraudulently obtained Microsoft and Google cloud environments, with offerings categorized by age, subscription type, and organization type, including educational institutions and nonprofits. Operators used legitimate organizations’ information to obtain cloud accounts, giving buyers low-cost access to infrastructure that appeared legitimate.
Turning stolen access into a service
Microsoft traced how YAM Store identified cloud environments, took control of accounts, and resold their resources. Operators used stolen application credentials to reset passwords, assign licenses, and maintain access. They converted compromised SharePoint and OneDrive storage into hosting services for buyers.
This application-level access helped operators retain control. Microsoft described the resulting persistence as “more durable, more scalable, and harder to detect.”
The marketplace created fake organizations to obtain cloud accounts, likely using AI-generated content and forged documents. Its storefront supported resellers and used Telegram for order notifications and communication with buyers.
Managing phishing in real time
According to technical analysis, Iron Man System contains more than 2,335 templates tailored to over 139 countries. The templates impersonate government agencies, banks, retailers, and delivery services, using local languages and brands.
They found that operators could receive Telegram notifications when victims submitted passwords, payment details, or verification codes. They could monitor each victim’s progress and manually control what appeared next.
The kits offer varying combinations of country-based access restrictions, IP address blocking, and fake CAPTCHA checks to hinder investigation. Buyers use the stolen information to access accounts and commit financial fraud.
Following the trail from Japan
The investigation began in late 2025 when Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. Investigators traced the activity to businesses selling accounts, hosting services, and phishing tools.
The company conducted test purchases to confirm how YAM Store operated. Investigators found cases in which operators acquired domains that legitimate organizations had allowed to expire, rebuilt their websites, and used those organizations’ identities to fraudulently obtain Microsoft 365 accounts for resale.
Disrupting the suppliers
Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man under an order from the US District Court for the Southern District of Florida.
They have disabled more than 20,000 accounts linked to YAM Store and was blocking more than 100,000 domains used for impersonation and fraud.
“The businesses behind it are what make it possible,” Microsoft said of the services supporting scam messages.
