Global Takedown Disrupts Phishing Network Behind More Than 1 Billion Messages
Summary
Law enforcement and industry partners disrupted YAM Store and linked phishing-kit infrastructure that targeted over 75,000 organizations in 150 countries. Microsoft seized or redirected domains, deactivated over 20,000 accounts, and blocked 100,000 domains.
Key points
- Investigators linked YAM Store to the CoGUI, Haozi, and Iron Man phishing kits, collectively tracked as Storm-2990.
- Microsoft said the platforms delivered over 750 million messages targeting Microsoft 365 customers since the start of 2026; more than 1 billion malicious messages targeted organizations overall.
- YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage.
- The phishing kits used lures including unpaid tolls, delivery problems, and account verification, and supported geofencing, fake CAPTCHA gates, and IP filtering.
- Many campaigns used device-code phishing to steal authentication tokens. Iron Man offered more than 2,300 impersonation templates.
- Under a U.S. court order, Microsoft and Health-ISAC seized and redirected supporting domains; Microsoft also deactivated over 20,000 associated accounts and blocked 100,000 domains.
- Investigators and partners said removal of additional infrastructure is ongoing.
Article Details
- Event Type
- International law-enforcement and industry disruption of a cybercrime marketplace and associated phishing infrastructure.
- Impact
- The ecosystem reportedly facilitated more than one billion malicious messages targeting over 75,000 organizations in 150 countries. Microsoft said its phishing platforms delivered more than 750 million messages targeting Microsoft 365 customers. Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man; Microsoft also deactivated over 20,000 associated accounts and blocked 100,000 domains used for impersonation and fraud. Further infrastructure removal was ongoing.
MITRE ATT&CK
Threat Actors
Vendors
CloudflareCurrently, more infrastructure is being removed based on the findings of the investigation, which also involves the Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.MicrosoftSince the start of the year, more than 750 million malicious messages have been aimed at Microsoft customers via email and SMS texts.OracleCurrently, more infrastructure is being removed based on the findings of the investigation, which also involves the Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.ProofpointIn late 2024, enterprise security company Proofpoint identified email campaigns "consistently targeting Japan" that were associated with the CoGUI phishing kit.ResecurityCybersecurity company Resecurity also participated in the investigation and shared more details about Iron Man after analyzing exposed infrastructure, including a publicly exposed Git/container registry with 911TRM LabsCurrently, more infrastructure is being removed based on the findings of the investigation, which also involves the Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
Products
Microsoft 365 Apps for EnterpriseMicrosoft said the phishing platforms delivered over 750 million messages targeting Microsoft 365 customers, many using device-code phishing to obtain authentication tokens.Microsoft OneDriveIn compromised Microsoft environments, the operators used stolen application credentials to manage accounts and licenses, and abused SharePoint and OneDrive storage for hosting.Microsoft SharePointIn compromised Microsoft environments, the operators used stolen application credentials to manage accounts and licenses, and abused SharePoint and OneDrive storage for hosting.
Tools
CoAceVFurther investigation into the phishing activity revealed that more than 17,000 domains were used by three kits known as CoGUI, CoAceV, and CoFish_Ws.CoFish_WsFurther investigation into the phishing activity revealed that more than 17,000 domains were used by three kits known as CoGUI, CoAceV, and CoFish_Ws.CoGUIactivity to YAM Store (Storm-3119), an underground infrastructure marketplace, then linked it to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.Haozito YAM Store (Storm-3119), an underground infrastructure marketplace, then linked it to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.Iron Man System(Storm-3119), an underground infrastructure marketplace, then linked it to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.
Countries
JapanFollowing an investigation initiated by Microsoft and Japan’s National Police Agency (NPA) into a wave of fraudulent activity, "a sprawling Chinese-language cybercrime marketplace" was discovered, with tools andUnited StatesMicrosoft says that CoGUI targeted victims in the United States and Japan, but Iron Man, which offers over 2,300 templates impersonating banks, retailers, delivery services, and government agencies, pushed it aside by