Microsoft has teamed up with industry and law enforcement partners to disrupt a major phishing infrastructure network which has targeted tens of thousands of organizations worldwide since January.
In a report published on October 14, Microsoft detailed how its work with Japanese police soon unravelled a network of Chinese-language phishing-as-a-service (PhaaS) kit operators, developers, and a marketplace selling tools and infrastructure.
“Threat actors purchased and used these tools and infrastructure, including phishing kits and access to compromised or fraudulent Microsoft or Google cloud environments and related credentials, to target organizations across the healthcare, financial services, wholesale distribution, and IT sectors in Japan, the US, Australia, and India,” it explained.
The phishing kits alone have been responsible for over a billion phishing emails and texts sent to over 75,000 organizations since January 2026, it added.
Read more on global phishing infrastructure: Global Takedown Neutralizes Tycoon2FA Phishing Service
The network centers around Yam Store, an underground marketplace tracked by Microsoft as Storm-3119.
Yam Store sells fraudulently obtained or compromised Microsoft and Google domains as well as offering three phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. The latter three kits are grouped under Storm-2990.
In terms of the phishing infrastructure, Yam Store operators found internet domains that legitimate organizations had allowed to expire.
“They then rebuilt the websites to make those organizations appear active, allowing them to fraudulently obtain Microsoft 365 accounts that could later be sold through Yam Store,” another Microsoft writeup explained.
“Storm-3119 resells the hijacked accounts, licenses, and storage through an automated storefront, operating as the access broker that supplies these resources to downstream operations.”
On other occasions, the group created fake organizations, likely using AI-generated content and forged documents, to establish Microsoft tenants.
Understanding Storm-2990
Yam Store sells the phishing infrastructure outlined above alongside the Storm-2990 kits.
“They are designed to impersonate organizations across several industry verticals to steal information, including sign-in credentials (usernames, passwords) and financial data (credit card information), used to gain access to network environments,” Microsoft said.
The lures focus on subjects like unpaid tolls and traffic fines, parcel-delivery issues, bank and government impersonation and fake login pages. The goal is credential stealing, device code phishing, and use of stolen payment data “to make fraudulent purchases of high-end goods or fraudulent transactions on legitimate financial platforms.”
It’s unclear how many consumers, as well as organizations, were targeted by Storm-2990 and Storm-3119 The kits feature a number of advanced evasion techniques including geofencing, fake CAPTCHA gates, and anti-detection configurations, the report claimed.
“Microsoft has already disabled more than 20,000 accounts connected to YAM Store and continues to dismantle the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud,” the tech giant noted.