Microsoft disrupts Yam Store PhaaS network (Storm-3119/Storm-2990) behind over one billion phishing messages since January 2026
Microsoft, working with industry partners and Japanese police, disrupted a Chinese-language phishing-as-a-service (PhaaS) ecosystem centered on Yam Store, an underground marketplace tracked as Storm-3119. The phishing kits sold there were responsible for over a billion phishing emails and texts sent to more than 75,000 organizations since January 2026. Targets were in healthcare, financial services, wholesale distribution and IT in Japan, the US, Australia and India. Microsoft has disabled more than 20,000 accounts tied to Yam Store and blocked more than 100,000 domains used for impersonation and fraud.
Detalhes técnicos
- Yam Store (Storm-3119) acts as an access broker. It sells fraudulently obtained or compromised Microsoft and Google domains, accounts, licenses and storage through an automated storefront.
- Operators registered expired domains that legitimate organizations had let lapse, then rebuilt the websites to make those organizations appear active. This let them fraudulently obtain Microsoft 365 accounts for resale. In other cases they created fake organizations, likely using AI-generated content and forged documents, to establish Microsoft tenants.
- Three phishing kits are grouped under Storm-2990: CoGUI (aka NX or FA), Haozi (aka Phoenix) and Iron Man System.
- The kits impersonate organizations across several verticals to steal sign-in credentials and payment card data. Lures include unpaid tolls and traffic fines, parcel-delivery issues, bank and government impersonation, and fake login pages. Objectives include credential theft, device code phishing, and fraudulent purchases or transactions using stolen payment data.
- The kits use evasion techniques such as geofencing, fake CAPTCHA gates and anti-detection configurations.
- It is unclear how many consumers, as opposed to organizations, were targeted.
Remediação
- The article describes Microsoft's takedown actions: disabling accounts, removing hosted infrastructure and blocking domains. It gives no specific defender guidance and no IOCs.
Linha do tempo
-
Microsoft disrupts Yam Store PhaaS network (Storm-3119/Storm-2990) behind over one billion phishing messages since January 2026
ler a análise desta fonte ocultar
Microsoft, working with industry partners and Japanese police, disrupted a Chinese-language phishing-as-a-service (PhaaS) ecosystem centered on Yam Store, an underground marketplace tracked as Storm-3119. The phishing kits sold there were responsible for over a billion phishing emails and texts sent to more than 75,000 organizations since January 2026. Targets were in healthcare, financial services, wholesale distribution and IT in Japan, the US, Australia and India. Microsoft has disabled more than 20,000 accounts tied to Yam Store and blocked more than 100,000 domains used for impersonation and fraud.
Technical Details
- Yam Store (Storm-3119) acts as an access broker. It sells fraudulently obtained or compromised Microsoft and Google domains, accounts, licenses and storage through an automated storefront.
- Operators registered expired domains that legitimate organizations had let lapse, then rebuilt the websites to make those organizations appear active. This let them fraudulently obtain Microsoft 365 accounts for resale. In other cases they created fake organizations, likely using AI-generated content and forged documents, to establish Microsoft tenants.
- Three phishing kits are grouped under Storm-2990: CoGUI (aka NX or FA), Haozi (aka Phoenix) and Iron Man System.
- The kits impersonate organizations across several verticals to steal sign-in credentials and payment card data. Lures include unpaid tolls and traffic fines, parcel-delivery issues, bank and government impersonation, and fake login pages. Objectives include credential theft, device code phishing, and fraudulent purchases or transactions using stolen payment data.
- The kits use evasion techniques such as geofencing, fake CAPTCHA gates and anti-detection configurations.
- It is unclear how many consumers, as opposed to organizations, were targeted.
Remediation
- The article describes Microsoft's takedown actions: disabling accounts, removing hosted infrastructure and blocking domains. It gives no specific defender guidance and no IOCs.