Microsoft disrupts phishing network behind more than a billion scam messages

A large-scale criminal infrastructure supporting global phishing operations has been disrupted following a joint effort between Microsoft and Resecurity. The operation centered on YAM Store, an underground marketplace that provided attackers with sophisticated phishing kits and fraudulent cloud infrastructure. By selling access to compromised Microsoft and Google environments, the marketplace allowed buyers to host scams on legitimate-looking infrastructure, making the campaigns more durable and harder for security systems to detect.
The scale of the operation was vast, with over one billion messages targeting 75,000 organizations across four primary countries. The tools utilized, specifically the Iron Man System, featured thousands of localized templates targeting banks and government agencies in 139 countries. The disruption involved the seizure of domains via a US federal court order and the disabling of tens of thousands of fraudulent accounts. While the immediate infrastructure has been neutralized, the sophistication of the "phishing-as-a-service" model highlights a systemic shift toward professionalized criminal supply chains.

* Microsoft and Resecurity identified a criminal marketplace called YAM Store.
* The marketplace, also called Storm-3119, sold phishing kits from developers grouped as Storm-2990.
* The kits include CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System.
* Over one billion phishing emails and SMS messages were sent since January 2026.
* Over 75,000 organizations in healthcare, financial services, wholesale distribution, and IT were targeted.
* Affected regions include Japan, the United States, Australia, and India.
* YAM Store sold compromised or fraudulently obtained Microsoft and Google cloud environments.
* Iron Man System contains more than 2,335 templates for over 139 countries.
* Payments were accepted via cryptocurrency.
* Communication and notifications were managed through Telegram.
* The US District Court for the Southern District of Florida issued an order for domain seizure.
* Over 20,000 accounts were disabled and 100,000 domains were blocked.

The strongest version of this narrative is that a major "force multiplier" in the cybercrime ecosystem has been dismantled, protecting tens of thousands of organizations from credential theft and financial fraud. It highlights the critical role of public-private partnerships and judicial intervention in neutralizing borderless digital threats.
The narrative relies on a centralized source of truth—the vendor who owns the infrastructure being attacked. Because the evidence is provided by the entity that manages the cloud environments, the reader is asked to accept the scale (one billion messages) and the attribution (Storm-3119/2990) without independent verification. This creates a dependency where the vendor is both the detective and the judge of the threat's magnitude.
Patterns detected: ARC-0061 Authority Game
This reflects a paradigm of "Platform Sovereignty," where a few global tech giants act as the primary intelligence agencies for the digital world. The unstated assumption is that the platform's internal telemetry is the definitive record of truth. This echoes the historical shift from state-led policing to corporate-led security governance. While this increases efficiency, it concentrates immense power in the hands of a few entities who decide what constitutes a "threat" and who is "disabled."
The second-order consequence is the professionalization of the "underground economy." As high-level suppliers are disrupted, the market will likely fragment into smaller, more resilient "boutique" shops, increasing the difficulty of future wholesale disruptions.
Bridge Questions:
1. How would the narrative change if the data were provided by a neutral third-party auditor rather than the service provider?
2. Does the "phishing-as-a-service" model suggest that the bottleneck for cybercrime is no longer technical skill, but rather access to legitimate infrastructure?
Counterstrike Scan: If this were a coordinated campaign, the playbook would involve amplifying the "threat" to justify more invasive platform monitoring or to discredit competitors' security. The actual content is a standard threat intelligence report and does not match a coordinated influence pattern.