Microsoft disrupts phishing network behind more than a billion scam messages

Microsoft, working with Resecurity, has exposed and dismantled an underground marketplace called YAM Store (tracked as Storm-3119) that sold phishing kits and stolen cloud accounts. Three kits — CoGUI, Haozi and Iron Man System — built by a group Microsoft labels Storm-2990, were used to send over a billion phishing emails and SMS messages since January 2026, hitting more than 75,000 organizations in healthcare, finance, wholesale distribution and IT across Japan, the US, Australia and India. Beyond phishing templates impersonating banks, retailers and government agencies in 139+ countries, the store also sold fraudulently obtained Microsoft and Google cloud accounts, repurposing compromised SharePoint and OneDrive storage as hosting infrastructure for buyers. Following a tip from Japan's police, Microsoft and Health-ISAC obtained a court order from the Southern District of Florida to seize domains, disabling over 20,000 linked accounts and blocking more than 100,000 fraud-related domains.