GoKawiilMicrosoft exposes Yam Store phishing network tied to 1 billion scam messages
Microsoft Threat Intelligence and its Digital Crimes Unit disclosed a Chinese-language phishing ecosystem built around a marketplace called Yam Store, tracked as Storm-3119. The operation sold phishing kits and infrastructure, including repurposed Microsoft and Google domains, and since January has sent over one billion phishing emails and texts to more than 75,000 organizations worldwide. Microsoft and Resecurity identified three kits used in the campaigns—CoGUI, Haozi/Phoenix, and Iron Man System—linked to developers tracked as Storm-2990.
GoKawiil's interpretation of the reporting above, not reported fact.
The use of expired or legitimate Microsoft and Google domains suggests attackers are deliberately exploiting trust signals that both victims and automated security tools rely on, making detection harder. The scale and kit-based structure indicate phishing has become an accessible, commercialized service, lowering the barrier for less skilled actors to launch large campaigns, a trend Microsoft suggests is compounded by AI tools that can generate convincing lures.
- Yam Store marketplace enabled sale of phishing kits and trustworthy-looking domain infrastructure.
- Over 1 billion phishing emails and SMS messages sent to 75,000+ organizations since January.
- Three kits—CoGUI, Haozi/Phoenix, Iron Man System—were tied to developers tracked as Storm-2990.
YubiKey 5 NFC Security Key — With phishing kits now mass-produced and distributed through marketplaces like Yam Store, passwords alone are no match for billions of malicious messages. A YubiKey adds hardware-based two-factor authentication that resists credential phishing even if attackers steal your login details. It's a simple, durable way to lock down your email and cloud accounts against exactly this kind of large-scale phishing campaign.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Alexander Culafi, 2026-10-14
Published there as: “Yam Store: The Phishing Network Behind a Billion Messages”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.