Microsoft Disrupts Global Phishing Network Behind More Than 1 Billion Malicious Messages

Law enforcement agencies and cybersecurity partners worldwide are disrupting a massive cybercrime ecosystem that facilitated more than 1 billion malicious messages targeting over 75,000 organizations in 150 countries.

Since the beginning of 2026, more than 750 million malicious messages have targeted Microsoft customers through email and SMS text messages.

An investigation led by Microsoft and Japan’s National Police Agency (NPA) uncovered what investigators described as a “vast Chinese-language cybercrime market” offering tools and services for large-scale phishing campaigns.

Investigators traced the activity to YAM Store, an underground infrastructure marketplace also tracked as Storm-3119. The marketplace was linked to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.

How the YAM Store phishing ecosystem worked

In its report, Microsoft said YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage.

In one method, operators acquired expired domains belonging to legitimate organizations, rebuilt their websites to make the defunct organizations appear active, and used those identities to obtain cloud accounts.

Investigators also observed criminals using artificial intelligence tools to create fake organizations, along with supporting content and documentation.

After gaining access to a Microsoft environment, operators used stolen application credentials to manage accounts and licenses. They also exploited SharePoint and OneDrive storage to host phishing content.

The phishing kits offered lures involving unpaid bills, traffic fines, delivery problems, and account verification requests.

The kits also supported geofencing, fake CAPTCHA pages, IP filtering, and other features designed to evade security analysis.

Microsoft said CoGUI targeted victims in the United States and Japan. Iron Man, which includes more than 2,300 templates impersonating banks, retailers, delivery services, and government agencies, had circumvented CoGUI by mid-2026.

Iron Man phishing kit offered thousands of impersonation templates

Cybersecurity firm ReSecurity also participated in the investigation. In an analysis of Iron Man, the company described exposed infrastructure that included a public Git and container registry containing 911 public builds and 8 registered accounts.

Researchers also identified a product-selection subsystem linked to payment-card theft. It cataloged 2,360 phishing packages covering 130 countries and regions, with listings updated through October 1, 2026.

Phishing campaign used device-code attacks against Microsoft 365 users

According to Microsoft, the phishing platforms delivered more than 750 million messages targeting Microsoft 365 customers. Many of the campaigns used device-code phishing to steal authentication tokens.

In late 2024, enterprise security company Proofpoint identified email campaigns that consistently targeted Japan and were associated with CoGUI phishing kits. The campaigns attempted to steal credentials and payment information by impersonating well-known Japanese companies and international organizations.

Further investigation found that the phishing operation used more than 17,000 domains across three kits: CoGUI, CoAceV, and CoFish_Ws.

Researchers described the operation as dynamic and sufficiently resourced to purchase and manage phishing infrastructure at scale.

Microsoft seizes phishing infrastructure and disables thousands of accounts

Under an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man.

Microsoft also disabled more than 20,000 accounts associated with YAM Store and blocked 100,000 domains used by cybercriminals for impersonation and fraud.

Additional infrastructure is being removed based on the investigation’s findings. The effort includes Japanese authorities, JC3, Cloudflare, Oracle, Proofpoint, and TRM Labs.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Reserve your seat