A Chinese-language phishing ecosystem is behind the deployment of more than a billion emails and SMS messages to tens of thousands of organizations in the past nine months alone.
Microsoft Threat Intelligence and Microsoft Digital Crimes Unit today published research concerning a cybercrime ecosystem dedicated to the tools and infrastructure needed to support phishing campaigns. The research covers phishing kit developers, phishing infrastructure sellers, and the customers of three of these kits.
At the center of the infrastructure side of the operation is Yam Store, a cybercrime marketplace Microsoft tracks as Storm-3119. Yam Store offered multiple phishing kits for sale and, perhaps most novel, Microsoft and Google domains associated with legitimate, expired, or previously used organizations, which allowed threat actors to operate phishing infrastructure that appeared more trustworthy to victims and automated defenses.
The phishing cybercrime ecosystem has picked up significant steam in recent years, facilitated by an influx of kits and services that enable newer threat actors to generate lures, send messages to possible victims at scale, and maintain the infrastructure to exploit stolen data. The rise of large language models (LLMs) exacerbated the issue, as threat actors can now use AI to spin-up convincing phishing sites or generate error-free email lures.
Microsoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System. Microsoft tracks the developers behind these kits, and surrounding activity, as Storm-2990. “Since January 2026, the threat actors behind these kits have been responsible for facilitating the sending of over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide,” Microsoft said.
A Chinese-Language Phishing Ecosystem
While Microsoft describes Yam Store as part of a Chinese-language cybercriminal ecosystem and assesses the phishing-kit developers are Chinese-speaking, the company tracks the infrastructure broker and the phishing-kit operators as distinct but closely connected groups.
According to the research, that infrastructure was then supplied to phishing-kit operators and other customers who used it to support large-scale phishing campaigns, while phishing kits such as CoGUI, Haozi, and Iron Man System were marketed through the same broader ecosystem.
Among the three kits, Microsoft highlighted Iron Man System in particular. Researchers said the Iron Man System includes more than “2,335 templates tailored to over 139 countries including Australia, Japan, India, and the United States, with the United States accounting for the most phishing templates.” Lures mimic various trusted brands and organizations including local government, law enforcement, healthcare, finance, transportation, and retail.
The end goal, as is often the case with phishing attacks, is to trick potential victims into giving up sensitive information, such as through a phony request to pay a parking fine.
The kits include evasion techniques like geofencing, fake CAPTCHA gates, IP address block and allow lists, anti-detection configuration to avoid security researchers, and Telegram bot configuration. Telegram is a popular threat actor tool for campaign coordination; Microsoft said kit customers can configure Telegram bots to send automatic notifications when a phishing target takes action on a lure, such as entering credentials or verification codes.
Cloud Domains for Sale at Yam Store
Microsoft says Yam Store functioned as an initial access broker, selling not just phishing tools but also infrastructure built on compromised or fraudulently obtained Microsoft and Google cloud environments.
“The Yam Store marketplace provides cybercriminals with a platform to purchase fraudulently acquired Microsoft and Google domains associated with legitimate, expired, or previously used organization numbers, allowing actors to use seemingly legitimate infrastructure and obtain workspaces at relatively low cost,” the blog post read. “Storm-3119 uses automation to identify expired environment or organization names and leverages legitimate customer information associated with them to help circumvent existing detections.”
Ross Filipek, CISO at Corsica Technologies, tells Dark Reading that the abuse of trusted cloud services is the most consequential aspect of this research from an everyday defender standpoint.
“Employees have been taught to check where a link takes them, but device code phishing throws a wrench into that protocol by leading them to genuine sign-in pages,” he says. “Training needs to address whether they initiated the request, and responders also need to investigate the access granted rather than assume a password reset finishes the job.”
Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ, similarly highlights cloud infrastructure abuse as deserving the closest attention, “particularly the application-only access used to administer compromised environments.”
“An application can have its own identity and permissions, with a client secret used to authenticate it,” Costis says. “Resetting a user’s password does not establish whether that separate access has been removed.”
Defending Against Yam Store-Enabled Attacks
Microsoft’s work did not solely involve identification of a phishing ecosystem. A spokesperson for the company tells Dark Reading that Microsoft has disabled more than 20,000 tenants connected to the Yam Store, which the company says was enabling over 140,000 malicious domains, while also strengthening safeguards “to better detect, prevent and disable fraudulent accounts.”
“As with every disruption, we use what we learn through the investigation to continuously improve our products and detections,” the Microsoft spokesperson says. “Here, that meant improving our ability to identify fraudulently obtained infrastructure and detect phishing activity operating through it.”
In the blog post, Microsoft included detections and indicators of compromise for its own products but also made a number of awareness-based recommendations for organizations. Namely, security teams should educate users about common phishing techniques as well as how to protect personal and business data on social media, how to filter unsolicited communication, and how to report suspicious activities.
“In nearly all the cases observed by Microsoft, the phishing lures used by the Storm-2990 operators followed prescriptive scam red flags, including urgency, time-sensitive tasks such as clicking a provided link with official branding,” Microsoft said. “Users should verify with the purported sender of the message or email, even when the task involves signing in to a known, secure account not provided by the link or calling the purported organization or company directly.”
