One Billion Phishing Messages, 75,000 Organizations, Three Kits Sold From One Shop

Microsoft's October 14 research on the YAM Store ecosystem answers a question a lot of businesses ask: why us? The answer is that nobody picked you. Someone bought a subscription, a target list and a thousand ready-made templates.

The least comfortable answer to “why would anyone phish us, we’re nobody” arrived on October 14, 2026. Nobody chose you. Somebody bought a subscription, and your details were already in the list that came with it.

That is the picture in new research from Microsoft Threat Intelligence and its Digital Crimes Unit, which spent the past year mapping a Chinese-language criminal ecosystem built around an underground marketplace it tracks as YAM Store (Storm-3119) and three phishing kits sold through it: CoGUI, Haozi and Iron Man System. Microsoft groups the developers behind all three as Storm-2990. Since January 2026, Microsoft says, the actors behind those kits facilitated more than one billion phishing emails and SMS messages aimed at over 75,000 organizations worldwide.

The detail that should interest anyone running a Microsoft 365 tenant is not the volume. It is where the messages came from. The marketplace was selling cloud environments at Microsoft and Google that had been compromised or obtained fraudulently, which means a good share of this mail arrived from infrastructure that looked exactly as legitimate infrastructure is supposed to look.

What Happened

Microsoft describes YAM Store as an initial access broker. It sold access to hijacked or fabricated cloud environments, sorted by the kind of attributes a buyer would care about: how old the tenant was, what subscription it carried, whether it was an education or nonprofit environment. Automation hunted for expired organization names and reused the legitimate customer details attached to them, which helped the resulting accounts slip past existing detections.

Some tenants were taken over. Others were invented. In one case described in the research, the operators stood up a fake nonprofit with a matching website and a recently registered .org domain, apparently to give a fictional charity enough credibility to obtain a tenant.

Once inside a real environment, the operators worked at the application layer rather than the user layer. Microsoft documents admin panels that used stolen application credentials to reset passwords quietly, without prompting the user to change anything at next sign-in, and to assign licenses and privileges the actor could later sell. Microsoft notes this kind of access is harder to spot and sticks around longer than a hijacked user session. Hijacked SharePoint and OneDrive storage became a product in its own right.

The kits sat downstream of all this. Iron Man System, the newest of the three, is a licensed subscription product with a hard-coded license server. Microsoft counted over 2,335 ready-made templates covering more than 139 countries, with the United States accounting for the largest share, mostly impersonating transportation and government bodies. The kits support geofencing, fake CAPTCHA gates, IP allow and block lists, and a Telegram bot that pings the operator in real time as a victim types. Microsoft’s analysis found credentials collected over a WebSocket, which lets the operator watch a session and decide what the victim sees next.

Downstream buyers used all of it for three things, per the research: stealing credentials, abusing the device code authentication flow to capture tokens for legitimate applications, and committing payment fraud.

The disruption itself was substantial. In a companion post on the takedown, Microsoft says it and Health-ISAC obtained an order from the United States District Court for the Southern District of Florida, seized and redirected the domains underpinning YAM Store, CoGUI and Iron Man, disabled more than 20,000 accounts linked to the marketplace, and moved to block more than 100,000 domains used for impersonation and fraud. The investigation began when Japan’s National Police Agency flagged scam campaigns in late 2025, and grew to include JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and the U.S. Secret Service. Microsoft puts the ecosystem’s reach at more than 150 countries, including over 750 million messages pointed at its own customers.

Why This Matters for Businesses

First, it settles an argument that a lot of small and mid-sized organizations have with themselves. The named victim sectors (healthcare, financial services, wholesale distribution and IT, in Japan, the United States, Australia and India) sound like somebody else’s problem. Microsoft heads that off directly, noting that what these buyers actually did were <em>”common attacks that could affect any organization.”</em> The ecosystem’s whole commercial purpose was to let people without much skill run campaigns at a scale they could never have built themselves. Scale is indiscriminate by design.

Second, it quietly retires a piece of security awareness training that most companies still rely on. “Check whether the sender domain looks legitimate” works when criminals register sketchy lookalike domains. It works considerably less well when the message originates from a real tenant with real licensing, or from a .org that belonged to a real charity until the registration lapsed. Asking employees to out-guess an infrastructure supply chain is not a control. It is a hope.

Third, there is a version of this story where your tenant is not the target but the merchandise. Microsoft describes stolen storage and licenses being resold as product. A compromised environment does not just cost you data. It can end up sending the next round of fraud with your organization’s name in the headers, which is a conversation nobody wants to have with customers, an insurer, or a regulator.

And fourth, the honest caveat about takedowns. This one was real and the numbers behind it are serious. But Microsoft also notes that CoGUI was already giving way to Iron Man by mid-2026, that payments ran through multiple channels, and that the ecosystem reaches beyond Microsoft’s own services. A disruption buys time. It does not retire the business model, because the business model is profitable and the customers are still out there.

What Organizations Should Consider

The encouraging part: because these attacks are commodity, so are the defenses that stop them. Nearly everything Microsoft recommends is configuration work inside licenses most businesses already pay for. Here are questions worth putting to your IT team or provider this month.

Which accounts can still get in with a password and a push notification? Microsoft’s guidance points to password-less options such as passkeys, with Conditional Access used to require phishing-resistant MFA on privileged accounts. Ask which groups are covered today and which were granted an exception two years ago that nobody revisited.

Where can someone register a new MFA method or passkey from? Microsoft recommends restricting registration to trusted locations and devices. Enrollment is the step attackers like most, because it is the one that turns a stolen password into lasting access.

How many Global Administrators do we have, and do they hold that role permanently? Microsoft observed these operators reaching Global Administrator level, and recommends least privilege and Zero Trust principles specifically to slow that down. If the answer to the first half is a number anyone has to think about, that is the finding. (We covered the practical side of this in our Zero Trust recap.)

Is Safe Links applied to internal mail, not just inbound? Microsoft calls this out explicitly, along with reviewing the recommended baseline settings for Exchange Online Protection and Defender for Office 365. Internal coverage matters precisely because one compromised colleague becomes the most trusted sender in the building.

Can we see every application and service principal consented in our tenant, and who approved them? The persistence in this campaign lived at the application layer, not in user sessions. A password reset does not touch it.

Does our business actually use device code sign-in? If the answer is no, or nobody is sure, that is worth a policy decision rather than an assumption, given Microsoft listed device code phishing among the downstream techniques.

What happens in the first ten minutes after someone reports a suspicious message? Not who gets the email. Who looks at it, who can pull the same message from every other mailbox, and who can kill the sessions and tokens of whoever already clicked. Reporting speed is a staff behavior. Response speed is an operational capability, and it is the one that determines whether a click becomes an incident.

Notice that none of this asks employees to be better at spotting fakes. Tell them to report anything that smells wrong and make reporting effortless, then put the real weight on authentication, access policy and tenant hygiene, which do not have a bad Monday.

How ISM Can Help

Most of the work above is tuning rather than buying. Our Cloud Solutions & Microsoft 365 team reviews tenant configuration against the kind of baseline Microsoft published here, including mail protection settings, Safe Links coverage and the application consents sitting in your directory that predate everyone currently employed.

Identity & Access Management is where the durable fix lives: moving privileged accounts to phishing-resistant methods, writing Conditional Access policies that hold up under pressure, and constraining where new credentials can be registered. Cybersecurity & Risk Management puts that into a prioritized plan rather than a list of forty findings, and our 24/7 Help Desk & Support closes the gap between a reported message at 4:50pm on a Friday and someone actually revoking tokens. Our Insight Managed Defense tier bundles the monitoring and response side for organizations that would rather not staff that themselves. You can see the full range on our services page.

Talk With Our Team

If you read the list of questions above and found yourself unsure about two or three of them, that is the normal result, and it is a good reason to spend half an hour with people who look at Microsoft 365 tenants all week. Get in touch and we will walk your environment with you: who holds privilege, what your mail protection is really doing, and how fast a reported phish turns into action.

Would rather get a read on where you stand before talking to anyone? The cyber insurance maturity alignment calculator maps your current controls against what underwriters and third parties tend to ask for, which is a useful mirror even if renewal is months away.

Sources

Sources