Coalition Disrupts Phishing-Kit Marketplace Behind 1 Billion-Plus Messages
A coalition led by Microsoft and Japan's National Police Agency (NPA), working with Health-ISAC, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, has disrupted YAM Store (tracked as Storm-3119) — an underground infrastructure marketplace that supplied the backbone for three widely used phishing kits: CoGUI, Haozi, and the Iron Man System (collectively tracked as Storm-2990). A U.S. District Court order from Florida authorized the seizure actions.
Scale of the Operation
| Metric | Figure |
|---|---|
| Malicious messages sent | Over 1 billion |
| Messages targeting Microsoft 365 | 750 million+ |
| Organizations affected | 75,000+ across 150 countries |
| Domains used by the kits | 17,000+ |
| Phishing templates offered | 2,300+ |
| Accounts deactivated | 20,000+ |
| Impersonation domains blocked | 100,000+ |
How the Ecosystem Operated
YAM Store sold access to compromised or fraudulently obtained Microsoft and Google tenant environments to other criminal operators. To build credible-looking phishing infrastructure, operators either acquired expired domains of real organizations and rebuilt them to look active again, or stood up fake organizations using AI tools. Phishing pages were then hosted using stolen cloud credentials and legitimate SharePoint/OneDrive storage — a technique that lets malicious content inherit the trust of Microsoft's own infrastructure.
The three kits sold through the marketplace came bundled with 2,300+ templates impersonating banks, retailers, delivery services, and government agencies, along with geofencing and anti-analysis features designed to dodge researchers and automated scanners.
Disruption Actions
Microsoft and Health-ISAC seized domains tied to the operation, deactivated more than 20,000 associated accounts, and blocked over 100,000 impersonation domains. No arrests were disclosed in connection with the takedown as of this report.
Why It Matters
The scale here — 1 billion-plus messages, 75,000 victim organizations, 150 countries — illustrates how a single infrastructure marketplace can power phishing campaigns far beyond what any one criminal group could build alone. Selling compromised tenant access plus hosting plus templates as a package lowers the bar for less-skilled operators to run convincing Microsoft 365 and Google Workspace phishing campaigns, and the use of stolen cloud storage to host payloads is a pattern defenders should expect to keep seeing as long as it continues to bypass reputation-based filtering.
Recommendations
- Audit SharePoint/OneDrive sharing links flowing through your tenant for signs of abuse — stolen storage hosting is now a core technique for this class of phishing infrastructure.
- Monitor for sign-ins from newly reactivated "expired domain" organizations in email threat intelligence feeds; this is a documented tactic of the disrupted ecosystem.
- Treat AI-generated "fake organization" lookalikes as a growing phishing vector — traditional domain-age and WHOIS heuristics are less reliable against operators who can stand up plausible-looking entities quickly.
- Report suspected Microsoft 365/Google Workspace tenant compromise promptly; account deactivation at scale, as seen in this takedown, depends on telemetry reported by affected organizations.
Key Takeaways
- Microsoft, Japan's NPA, and a coalition of partners dismantled YAM Store, a marketplace supplying three phishing kits — CoGUI, Haozi, and Iron Man System.
- The operation sent over 1 billion malicious messages, with 750 million+ targeting Microsoft 365 customers across 75,000 organizations in 150 countries.
- Operators used stolen cloud credentials and legitimate SharePoint/OneDrive storage to host phishing content, plus AI-generated fake organizations and reactivated expired domains for credibility.
- The takedown deactivated 20,000+ accounts and blocked 100,000+ impersonation domains, though no arrests have been announced.