More than a billion malicious messages have been linked to a single, sprawling criminal ecosystem that sent phishing lures at over 75,000 organizations in 150 countries, according to investigators who traced the operation to an underground marketplace and multiple phishing kits.
The scale: volume, targets, and Microsoft-specific impact
Investigators report the campaign delivered more than 1 billion malicious messages worldwide. Since the start of 2026, Microsoft says over 750 million of those messages were aimed at Microsoft customers via email and SMS. The targeting reached an estimated 75,000 organizations across 150 countries, and many of the messages relied on device-code phishing to obtain authentication tokens.
YAM Store (Storm-3119) and the Storm-2990 phishing kit family
Microsoft and Japan’s National Police Agency (NPA) initiated the investigation that uncovered what the teams described as "a sprawling Chinese-language cybercrime marketplace." The operation centered on YAM Store (tracked as Storm-3119), an underground infrastructure marketplace that sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage.
Investigators then linked YAM Store to a set of phishing kits—CoGUI, Haozi, and Iron Man System—collectively tracked as Storm-2990. Microsoft reported that CoGUI targeted victims in the United States and Japan, while Iron Man grew rapidly and "pushed it aside by mid-2026."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTechniques and tooling: domain resurrection, fake organizations, and sophisticated phish kits
The operators used a range of techniques to create credible-looking lures and hosting infrastructure. They acquired expired domains belonging to real organizations and rebuilt defunct websites so those entities appeared active again. The group also generated entirely fake organizations — complete with content and documentation — using AI tools.
Once cloud resources were in hand, stolen application credentials were used to manage accounts and licenses, and SharePoint and OneDrive storage were abused to host phishing infrastructure. The phishing kits offered a broad menu of lures — unpaid tolls, traffic penalties, delivery problems, and account verification requests — and included operational controls designed to impede defenders, such as geofencing, fake CAPTCHA gates, and IP filtering.
Resecurity’s analysis of exposed Iron Man infrastructure revealed a publicly exposed Git/container registry with 911 published builds and eight registered accounts. The researchers also identified a product-selection subsystem tied to payment-card capture and cataloged 2,360 phishing packages covering 130 countries/areas, with updates continuing through October 1, 2026. Iron Man alone offered over 2,300 templates impersonating banks, retailers, delivery services, and government agencies.
Legal and technical disruption: court-ordered seizures and platform actions
Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains used to support YAM Store, CoGUI, and Iron Man. The company deactivated more than 20,000 accounts associated with YAM Store and blocked 100,000 domains the cybercriminals used for impersonation and fraud.
Microsoft said additional infrastructure is being removed on the basis of the investigation’s findings. The takedown involved cooperation with Japanese authorities and a range of private- and public-sector partners, including JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
What this means for technologists and security teams, affected enterprises and end users
- Technologists and security teams: Expect to see phishing infrastructure that leverages legitimate cloud storage and application credentials; device-code phishing and geofencing are explicit techniques in use, and detection efforts must account for hosted content on SharePoint and OneDrive as well as widespread template reuse (2,360 packages and 2,300+ templates were observed).
- Affected enterprises and procurement leaders: The operation’s use of expired domain resurrection and AI-generated fake organizations highlights the need to monitor expired domains and validate third-party proofs of identity before provisioning cloud accounts or licenses to minimize supply-chain-style account fraud.
- End users and the general public: Lures included unpaid tolls, traffic penalties, delivery problems, and verification requests delivered by email and SMS; many messages aimed specifically at Microsoft 365 customers, and device-code phishing was used to capture authentication tokens, making caution with unexpected verification flows especially important.
The takedown demonstrates how quickly an organized underground marketplace—selling rebuilt domains, cloud accounts, and turnkey phishing kits—can scale global campaigns. While the court-ordered seizures, account deactivations, and domain blocks disrupted a major portion of the infrastructure, Microsoft and its partners say removal of additional elements is ongoing, and Resecurity’s findings show active development and updates through October 1, 2026. The operation’s combination of AI-assisted identity fabrication, cloud-account abuse, and high-volume templateized phishing leaves open the question of how defenders and platforms will detect and deter similarly automated ecosystems going forward.
