Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

Microsoft partnered with industry and law enforcement to disrupt a phishing infrastructure network that has targeted organizations globally since January. The collaboration revealed a network of operators, developers, and a marketplace facilitating phishing-as-a-service (PhaaS). The investigation uncovered that threat actors used these tools to target entities across various sectors, including healthcare, finance, wholesale distribution, and IT in Japan, the US, Australia, and India.
The network was centered around Yam Store, an underground marketplace tracked by Microsoft as Storm-3119. This platform sold fraudulently obtained or compromised Microsoft and Google domains, along with three phishing kits: CoGUI (or NX/FA), Haozi (or Phoenix), and Iron Man System, which are grouped under Storm-2990. The operators found expired domains and rebuilt websites to maintain the illusion of legitimacy, allowing them to fraudulently obtain Microsoft 365 accounts that were then sold.
The phishing infrastructure was used to impersonate organizations across multiple verticals to steal credentials and financial data. Lures included impersonating entities related to unpaid tolls, traffic fines, parcel delivery issues, banks, and governments to facilitate credential stealing, device code phishing, and fraudulent transactions on legitimate platforms. The kits employed evasion techniques like geofencing and fake CAPTCHA gates. Microsoft has taken action by disabling over 20,000 connected accounts and blocking over 100,000 impersonation domains.

* Microsoft teamed up with industry and law enforcement to disrupt a phishing infrastructure network.
* The network targeted tens of thousands of organizations worldwide since January.
* Work with Japanese police unraveled a network of Chinese-language phishing-as-a-service (PhaaS) kit operators, developers, and a marketplace.
* Threat actors used tools and infrastructure including phishing kits and access to compromised/fraudulent Microsoft or Google cloud environments and credentials.
* Phishing kits caused over a billion phishing emails and texts sent to over 75,000 organizations since January 2026.
* The network centered around Yam Store, tracked by Microsoft as Storm-3119.
* Yam Store sold fraudulently obtained or compromised Microsoft and Google domains.
* Yam Store offered phishing kits: CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System (grouped under Storm-2990).
* Operators found expired domains and rebuilt websites to obtain Microsoft 365 accounts for sale.
* Storm-3119 resells hijacked accounts, licenses, and storage through an automated storefront.
* The phishing infrastructure aimed to steal sign-in credentials, financial data, and access to network environments.
* Lures included impersonating unpaid tolls, fines, parcel delivery issues, banks, and governments.
* The kits featured evasion techniques such as geofencing and fake CAPTCHA gates.
* Microsoft disabled more than 20,000 accounts connected to Yam Store and blocked over 100,000 impersonation domains.

The operation highlights a critical dynamic where digital infrastructure—specifically domain control and cloud identity management—is commodified and weaponized. The existence of an underground marketplace like Yam Store demonstrates a systemic failure in the security ecosystem where compromised or expired digital assets can be easily leveraged into exploitable commodities. The transition from simple credential theft to operating a sophisticated PhaaS network that involves AI-generated content for fake organizations suggests an escalation where low-level vulnerabilities are synthesized into high-volume, scalable criminal enterprises.
The pattern observed is the commodification of trust. Legitimate organizational identities (domains, cloud accounts) cease to be protected entities and become tradable assets, enabling a tiered attack structure: initial access via phishing kits creates the commodity, which is then brokered through marketplaces to facilitate large-scale fraudulent transactions targeting specific verticals like finance and healthcare. The use of advanced evasion techniques within the kits points toward an arms race where defensive measures must constantly evolve against sophisticated offensive tooling.
The implication for agency is stark: security defenses are no longer sufficient; resilience requires not just patching individual systems but understanding and controlling the flow of digital assets at the foundational level. If organizations cannot secure their basic identities, they become raw material in a scalable criminal supply chain. The focus should shift from reactive defense to proactive control over asset lifecycle and identity provenance.
Bridge Questions: What systemic safeguards are necessary to prevent expired or compromised legitimate organizational assets from being readily available for trade? How can regulatory frameworks evolve to address the cross-jurisdictional flow of these digital commodities? What institutional changes are required to shift security focus from perimeter defense to identity sovereignty?