The phishing kits alone have been responsible for over a billion phishing emails and texts sent to over 75,000 organizations since January 2026.
How Microsoft and Japanese police exposed Yam Store (Storm-3119)
Microsoft said it worked with industry partners and Japanese police to unravel an underground marketplace it tracks as Storm-3119, commonly referred to in the report as Yam Store. According to Microsoft, the operation combined a storefront model with tools and services that threat actors could buy or lease: “Storm-3119 resells the hijacked accounts, licenses, and storage through an automated storefront, operating as the access broker that supplies these resources to downstream operations.”
The marketplace sold fraudulently obtained or compromised Microsoft and Google domains, and it facilitated resale of accounts and cloud resources that other operators used in phishing campaigns.
Storm-2990 phishing kits: CoGUI, Haozi and Iron Man System
Yam Store marketed three phishing kits grouped under Storm-2990: CoGUI (also tracked as NX or FA), Haozi (also called Phoenix), and Iron Man System. Microsoft described these kits as “designed to impersonate organizations across several industry verticals to steal information, including sign-in credentials (usernames, passwords) and financial data (credit card information).”
Microsoft said the lures used by the kits included unpaid tolls and traffic fines, parcel-delivery issues, bank and government impersonation, and fake login pages. The stated aims were credential theft, device code phishing, and use of stolen payment data “to make fraudulent purchases of high-end goods or fraudulent transactions on legitimate financial platforms.”
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTechniques: domain hijacking, fake tenants and anti-detection measures
The operator tactics combined opportunistic domain reuse with fabricated organizational identity. Microsoft reported that operators located internet domains that legitimate organizations had allowed to expire, then “rebuilt the websites to make those organizations appear active, allowing them to fraudulently obtain Microsoft 365 accounts that could later be sold through Yam Store.”
In other cases, Microsoft said the group created fake organizations—“likely using AI-generated content and forged documents”—to establish Microsoft tenants. The kits also included advanced evasion techniques such as geofencing, fake CAPTCHA gates, and anti-detection configurations intended to frustrate automated analysis and avoid broad takedown.
Scale, sectors and Microsoft’s mitigation actions
Microsoft attributed massive scale to the combined operations: over one billion phishing messages and more than 75,000 targeted organizations since January 2026. The company said the campaigns targeted organizations across healthcare, financial services, wholesale distribution, and IT sectors in Japan, the US, Australia, and India. Microsoft also noted it was “unclear how many consumers, as well as organizations, were targeted by Storm-2990 and Storm-3119.”
In response, Microsoft reported it had “already disabled more than 20,000 accounts connected to YAM Store and continues to dismantle the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.”
What this means for technologists, affected enterprises, and law enforcement
- Technologists and security teams: Expect adversaries to reuse expired domains and to establish fake tenants; the presence of geofencing, fake CAPTCHA gates and anti-detection settings means detection and takedown will require both behavioral analysis and careful domain/tenant hygiene.
- Affected enterprises and procurement leaders: Expired corporate domains and neglected tenant lifecycle controls can be monetized by automated marketplaces; organizations will want to track domain expirations and the integrity of tenant registration processes.
- Law enforcement and platform providers: Microsoft’s collaboration with Japanese police that helped expose the marketplace illustrates the cross-border, intersectoral work required to disrupt automated access-brokering and phishing-as-a-service ecosystems.
Microsoft’s takedown removed thousands of accounts and blocked six-figure numbers of impersonation domains, yet the one-billion-message figure underscores a business model built on scale: automated storefronts, resold access and reusable phishing kits. The record in the report leaves a concrete open point—how many individual consumers were ensnared—while documenting a familiar calculus for defenders: tools that lower the bar for fraud will continue to be attractive unless tenancy, domain and credential controls keep pace.
