Microsoft has made significant strides in combating cybercrime by collaborating with law enforcement agencies and industry stakeholders to dismantle a major phishing infrastructure network. This initiative targets a vast array of organizations around the globe, highlighting the critical need for cooperative efforts in tackling cyber threats.
In a comprehensive report released on October 14, Microsoft detailed its partnership with Japanese authorities, which played a pivotal role in dismantling a network primarily operated by Chinese-language phishing-as-a-service (PhaaS) kit developers and marketplace vendors. These entities sold various tools and infrastructure essential for executing sophisticated phishing schemes.
According to Microsoft, the phishing kits that were exposed by this operation have been responsible for disseminating over a billion phishing emails and text messages to more than 75,000 organizations since January 2026. The targeted industries ranged from healthcare and financial services to wholesale distribution and IT sectors, with victims located in Japan, the United States, Australia, and India.
Central to this extensive phishing network is a marketplace known as the Yam Store, tracked by Microsoft under the designation Storm-3119. This underground platform facilitated the sale of fraudulently acquired or compromised Microsoft and Google domains. The Yam Store also offered several phishing kits, notably CoGUI (also referred to as NX or FA), Haozi (known as Phoenix), and Iron Man System, which collectively fall under the Storm-2990 classification. These tools allowed malicious actors to craft convincing impersonations, making it easier to deceive and exploit unsuspecting victims.
Yam Store operators have been reported to extensively utilize expired domains, previously owned by legitimate organizations. By reinstating these domains, they created the illusion that these businesses were operational, thus enabling them to illegitimately acquire Microsoft 365 accounts. These accounts were subsequently sold through the Yam Store, creating a revenue stream for the cybercriminals involved.
In another disturbing tactic, members of this phishing network were found to establish fake organizations, potentially leveraging AI-generated content and falsified documentation to create Microsoft tenants. This deception further illustrates the evolving sophistication of cybercrime operations, where traditional methods are augmented by advanced technology.
The phishing infrastructure propagated from the Yam Store also included advanced techniques aimed at bypassing detection. Microsoft has noted that these phishing kits are designed to impersonate organizations across various sectors with the explicit goal of stealing sensitive information, including usernames, passwords, and financial data such as credit card numbers. This stolen information is then used to infiltrate network environments, posing significant risks to both individual consumers and businesses.
The phishing tactics employed by these criminals were varied and alarming. They often centered around urgent and enticing subjects, such as unpaid tolls, traffic fines, parcel delivery issues, and impersonations of banks and government agencies. By employing fake login pages, they aimed not only to solicit sensitive credentials but also to exploit stolen payment information for making fraudulent purchases of high-end goods and conducting illicit financial transactions.
Despite the gravity of the situation, Microsoft has taken substantial measures to mitigate the damage caused by these phishing threats. The tech giant has already disabled over 20,000 accounts linked to the Yam Store and is actively working to dismantle the operational infrastructure associated with this network. This includes removing hosting services utilized by the offenders and blocking more than 100,000 domains used for impersonation and fraudulent activities.
While it remains unclear precisely how many consumers and organizations were affected by the Storm-2990 and Storm-3119 operations, the advanced evasion techniques employed—such as geofencing, fake CAPTCHA gates, and anti-detection mechanisms—indicate a high level of sophistication in their approach.
Microsoft’s latest efforts underscore the urgent need for vigilance and collaboration among industry and law enforcement partners globally to protect against the ever-evolving landscape of cyber threats. The fight against cybercrime is far from over, and as Microsoft continues to dismantle these networks, the focus remains on securing digital environments, safeguarding sensitive data, and ensuring that organizations can operate with greater peace of mind in an increasingly perilous cyber world.