Microsoft has worked with law enforcement and industry partners to take down a massive phishing infrastructure that sent over one billion phishing emails and texts to more than 75,000 organizations worldwide since January 2026. In a report published on October 14, the tech company revealed how collaboration with Japanese police exposed a network of Chinese-language phishing-as-a-service kit operators, developers, and an underground marketplace selling tools and infrastructure. The campaign targeted organizations across healthcare, financial services, wholesale distribution, and IT sectors in Japan, the United States, Australia, and India.
The network revolves around Yam Store, an underground marketplace that Microsoft tracks as Storm-3119. Yam Store sells fraudulently acquired or compromised Microsoft and Google domains and offers three phishing kits: CoGUI (also known as NX or FA), Haozi (also called Phoenix), and Iron Man System, which Microsoft groups together as Storm-2990. The phishing kits feature advanced evasion techniques including geofencing, fake CAPTCHA gates, and anti-detection configurations. Microsoft has already disabled more than 20,000 accounts connected to Yam Store and blocked over 100,000 domains used for impersonation and fraud.
According to the report, the kits "are designed to impersonate organizations across several industry verticals to steal information, including sign-in credentials (usernames, passwords) and financial data (credit card information), used to gain access to network environments." The phishing lures focus on subjects like unpaid tolls and traffic fines, parcel-delivery problems, bank and government impersonation, and fake login pages. The goals include credential stealing, device code phishing, and use of stolen payment data "to make fraudulent purchases of high-end goods or fraudulent transactions on legitimate financial platforms."
The report explains that Yam Store operators acquired phishing infrastructure by finding internet domains that legitimate organizations had allowed to expire. They then rebuilt the websites to make those companies appear active, which allowed them to fraudulently obtain Microsoft 365 accounts that could later be sold through Yam Store. In other cases, the group created fake organizations, likely using AI-generated content and forged documents, to establish Microsoft tenants. Storm-3119 resells the hijacked accounts, licenses, and storage through an automated storefront, operating as the access broker that supplies these resources to downstream operations. This model allowed threat actors to purchase ready-made phishing infrastructure and kits without needing technical expertise, dramatically lowering the barrier to entry for large-scale phishing campaigns.
Microsoft continues to dismantle the operation by removing infrastructure hosted on its services and working with law enforcement partners globally. The company's response includes ongoing monitoring to detect and disable fraudulent accounts and domains connected to the network. For organizations in the affected sectors, this takedown represents a significant reduction in phishing threats from this particular infrastructure, though the report doesn't specify how many consumers were also targeted by the network. The scale of this operation—reaching tens of thousands of organizations through a billion messages in less than a year—shows how phishing-as-a-service platforms can amplify threats when they combine stolen cloud credentials with easy-to-use attack kits. Companies that prioritize credential security and employee training will be better positioned to detect the next wave of attacks, while those that treat phishing as a technical problem rather than an organizational one may find themselves repeatedly exposed.