GoKawiilMicrosoft exposes Yam Store phishing network tied to 1 billion scam messages
Microsoft Threat Intelligence and its Digital Crimes Unit disclosed a Chinese-language phishing ecosystem built around a marketplace called Yam Store, tracked as Storm-3119. The operation sold phishing kits and infrastructure, including repurposed Microsoft and Google domains, and since January has sent over one billion phishing emails and texts to more than 75,000 organizations worldwide. Microsoft and Resecurity identified three kits used in the campaigns—CoGUI, Haozi/Phoenix, and Iron Man System—linked to developers tracked as Storm-2990.