“These messages are relentless,” Steven Masada wrote, summing up an operation Microsoft says delivered more than 1 billion phishing emails and SMS messages to over 75,000 organizations since the start of the year.
Scope of the abuse: Storm-2990 and a billion-plus messages
Microsoft identified the activity as a cluster it tracks as Storm-2990 and said the campaigns reached more than 75,000 organizations globally. More than three-quarters of the malicious messages targeted Microsoft customers, the company reported. Researchers tied the volume to a commercial ecosystem of Chinese-language phishing kits that operators purchased, customized and deployed at scale.
The tools: YAM Store, CoGUI and Iron Man
At the center of the disruption were three named services: YAM Store, CoGUI and Iron Man. Microsoft and partners said those services supplied phishing kits, templates and infrastructure to criminal customers. Working with Japanese authorities and Health-ISAC, and under a federal court order, Microsoft said it seized and redirected domains that powered the underlying infrastructure for those services, disabled more than 20,000 accounts connected to YAM Store, removed infrastructure hosted on Microsoft services, and blocked more than 100,000 domains used for impersonation and fraud.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the kits were used: credential theft, device-code abuse and high-end fraud
Researchers said the kits included templates impersonating legitimate brands—banks, retailers, healthcare providers, transportation authorities, police departments and government agencies—enabling high-volume campaigns. Microsoft and its investigators reported that criminals used the tools to steal credentials and financial data, and that they abused the device code authentication process to obtain authentication tokens and access compromised accounts. The primary criminal outcome reported was financial fraud: investigators said stolen payment data was used to make fraudulent purchases of high-end goods or to transact on otherwise legitimate financial platforms.
Investigative footprint: partners, access and evidence
Microsoft described the operation as an “interconnected network” investigators began probing in early 2025. Health-ISAC aided seizure efforts under a federal court order; Japanese authorities joined the inquiry; and private companies contributed intelligence and access. Resecurity gained access to Iron Man’s infrastructure and reported finding 2,360 phishing templates that impersonated organizations across 130 countries. Cloudflare, Oracle, Proofpoint and TRM Labs also provided research and investigative support, Microsoft said.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Microsoft’s actions included disabling over 20,000 accounts tied to YAM Store, removing infrastructure hosted on Microsoft services, and blocking 100,000-plus domains. Teams should note the reported code reuse and overlapping infrastructure—researchers said similarity in tooling suggested shared development origins or close collaboration among developers—because those signals can inform detection and takedown strategy.
- Affected enterprises and procurement leaders: Organizations in healthcare, financial services, logistics and IT—sectors highlighted by Microsoft—should be aware that these kits were sold commercially and used to mount high-volume campaigns. The availability of thousands of templates across 130 countries indicates impersonation risk across many brands and geographies.
- End users and the general public: Microsoft quoted typical lures—alerts about packages, unpaid tolls, bank issues or overdue taxes—and urged vigilance. “Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue,” Steven Masada wrote. He warned that deleting one message often leads to another and that falling for a single scam can lead to broader account compromise.
Microsoft framed the disruption as a move against the commercial services that make large-scale scams possible. “YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” Masada wrote. Resecurity’s cataloguing of 2,360 templates across 130 countries and Microsoft’s numbers—over 1 billion messages, tens of thousands of disabled accounts, and six-figure domain blocks—underscore both the scale of the abuse and the operational levers investigators applied.
The action removes a visible layer of capability used by Chinese-language phishing services and their customers, but Microsoft acknowledged these named services were components of a broader underground market. The company said it will continue disrupting operations by removing hosted infrastructure and blocking domains while partners pursue legal and investigative avenues.
