Microsoft Threat Intelligence and its Digital Crimes Unit disclosed a Chinese-language phishing ecosystem built around a marketplace called Yam Store, tracked as Storm-3119. The operation sold phishing kits and infrastructure, including repurposed Microsoft and Google domains, and since January has sent over one billion phishing emails and texts to more than 75,000 organizations worldwide. Microsoft and Resecurity identified three kits used in the campaigns—CoGUI, Haozi/Phoenix, and Iron Man System—linked to developers tracked as Storm-2990.
Microsoft and Japan's National Police Agency disrupted a cybercrime operation centered on a marketplace called YAM Store and two phishing kits, CoGUI and Iron Man. Since January 2026, the network had reportedly sent over one billion malicious messages to more than 75,000 organizations in 150+ countries, including 750 million aimed at Microsoft customers, generating tens of millions of dollars for operators.
Microsoft and Japan's National Police Agency disrupted a cybercrime ecosystem that sent over a billion phishing messages to more than 75,000 organizations in 150 countries, including over 750 million targeting Microsoft customers this year. The investigation traced the activity to a marketplace called YAM Store, linked to phishing kits CoGUI, Haozi and Iron Man System, which sold compromised Microsoft and Google accounts and hijacked domains to impersonate real organizations.
GoKawiil