Microsoft seizes phishing kits behind 1 billion messages this year

Microsoft said on October 14 that it had taken control of the web domains behind three Chinese-language crime services: YAM Store, CoGUI and Iron Man. On October 7 a federal court in the Southern District of Florida issued a temporary restraining order, sought by Microsoft and Health-ISAC, the health sector's threat-sharing group, that let them seize and redirect the domains. Microsoft says the services were used to send more than 1 billion phishing emails and text messages since January, aimed at more than 75,000 organizations.

The scale is one reason this matters to IT teams. The method is the other. Microsoft's threat report says YAM Store took over real Microsoft 365 tenants, gave itself admin rights and rented the tenants out, so the phishing was sent and hosted from inside Microsoft's own cloud.

Three services, one supply chain

Microsoft tracks the kit developers as Storm-2990 and the YAM Store operators as Storm-3119.

CoGUI sold ready-made fake websites and text messages copying banks, government offices and tech brands. The Record reports that Japan was its main target until criminals moved to Iron Man in mid-2026.

Iron Man offered more than 2,335 page templates covering over 139 countries, from parking fine notices to bank logins, according to Microsoft. Operators watched victims in real time and chose what page they saw next. Stolen passwords, card numbers and one-time codes arrived through Telegram bots.

YAM Store was the access shop. It sold compromised or fake Microsoft and Google accounts, Microsoft 365 licenses and storage.

Microsoft describes how Storm-3119 worked. It scanned for Microsoft 365 tenants over Tor, used stolen app credentials to reset passwords quietly, reached Global Administrator, then created a service principal with wide Microsoft Graph and SharePoint permissions. SharePoint and OneDrive then hosted phishing content. The group also built fake company websites, probably with AI-written text, so the tenants looked like real businesses.

Victims lost more than passwords. Microsoft says the kits were used for device code phishing, where a user is tricked into entering a code that hands an attacker a sign-in token, and for card fraud. Targets included health care, financial services, wholesale distribution and IT, mostly in Japan, the US, Australia and India.

What the takedown did

Microsoft says it disabled more than 20,000 accounts tied to YAM Store, is blocking over 100,000 impersonation domains and is removing infrastructure hosted on its own cloud. Japan's National Police Agency, which tipped Microsoft off in late 2025, took part, along with Proofpoint, Resecurity, TRM Labs, Cloudflare and Oracle. No arrests have been announced.

Of the 1 billion messages, more than 750 million were aimed at Microsoft customers, Cybersecurity Dive reports. Steven Masada, who runs Microsoft's Digital Crimes Unit, told CyberScoop that blocking one service only makes room for another, and that the businesses selling these tools are the real target.