Microsoft identifies global phishing-kit market behind a billion-plus attack messages

Microsoft links three phishing kits to YAM Store, a marketplace selling illicit cloud accounts and infrastructure. Its figures track malicious messages, not confirmed breaches of every targeted organisation.

Microsoft identified a global phishing-kit market that helped send more than one billion phishing emails and text messages since January 2026, according to findings published on 14 October. The company linked the activity to tools targeting more than 75,000 organisations worldwide and reported a coordinated operation against some of the infrastructure supplying the attacks.

In its investigation, Microsoft Threat Intelligence and the Digital Crimes Unit described two connected operations: phishing-kit developers tracked as Storm-2990 and YAM Store, an illicit marketplace tracked as Storm-3119. The reported message volumes reflect Microsoft’s assessment of malicious activity, not confirmed breaches of 75,000 organisations.

YAM Store sold access to cloud environments

Microsoft says YAM Store sold compromised or fraudulently acquired accounts and cloud resources associated with Microsoft and Google. The marketplace traded access to environments belonging to educational and nonprofit organisations, including accounts obtained through expired domains and fabricated organisational identities.

Such infrastructure allowed customers to send messages or host fraudulent sites using cloud services that appeared to have legitimate organisational ties. Microsoft’s researchers traced YAM Store’s links to three phishing kits—CoGUI, Haozi and Iron Man System—sold to other operators who carried out campaigns.

Phishing kits offered thousands of ready-made lures

Microsoft tracked the kit developers and related activity as Storm-2990. CoGUI, Haozi and Iron Man provided templates impersonating banks, government agencies, delivery services and other trusted organisations. The Iron Man System alone contained more than 2,300 templates, according to Microsoft’s research.

The kits supported credential theft and payment-card fraud. Some allowed country-based filtering, fake CAPTCHA challenges and real-time notification when targets entered information. Microsoft assessed with high confidence that Chinese-speaking actors developed the kits; that finding does not establish the operators’ nationality or government involvement.

Microsoft and partners disrupted parts of the network

Working with Health-ISAC and international partners, Microsoft obtained a US court order and seized or redirected domains supporting YAM Store, CoGUI and Iron Man. In its 14 October disruption announcement, Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and blocked more than 100,000 domains associated with impersonation and fraud.

The operation followed investigative assistance from Japanese police and other partners. Microsoft reported that the broader phishing activity reached people and organisations in more than 150 countries, including healthcare, financial services and technology targets.

Those actions disrupted named services and infrastructure, but Microsoft did not claim that every customer of the phishing kits had been identified or that all resulting fraudulent activity had ended.