Microsoft Details Phishing-Kit Ecosystem Behind Billion-Message Campaigns
Summary
Microsoft describes a Chinese-language phishing ecosystem that enabled over one billion phishing emails and SMS messages targeting more than 75,000 organizations since January 2026. Its investigation also helped disrupt key developers and infrastructure.
Key points
- Storm-3119’s YAM Store allegedly resold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage to phishing-kit operators and other criminals.
- Microsoft describes a five-stage operation involving reconnaissance, takeover of Microsoft 365 tenants, abuse of privileged credentials and cloud storage, phishing infrastructure, and resale.
- The Storm-2990 cluster includes CoGUI, Haozi, and Iron Man System kits, which provide impersonation templates and support large-scale credential and payment-data theft.
- Iron Man System has over 2,335 templates for more than 139 countries and can use geofencing, fake CAPTCHA checks, IP filtering, and Telegram notifications for real-time credential collection.
- Downstream actors used the kits for credential theft, device-code phishing, and financial fraud, with targets reported across healthcare, finance, wholesale distribution, and IT.
- Microsoft says its Digital Crimes Unit, law enforcement, and partners disrupted the ecosystem’s primary developers and infrastructure; it recommends phishing-resistant MFA, least privilege, and email and network protections.
Article Details
- Attack Vectors
- Storm-3119 uses automated reconnaissance to identify and profile cloud-enabled organizations and Microsoft 365 tenants, including enrollment opportunities, licensing, and Azure cloud information.
- Storm-3119 takes over Microsoft 365 and Azure for Education tenants using stolen application credentials and application-only authentication, then silently resets passwords, assigns licenses, and grants privileged access.
- Storm-3119 abuses compromised tenants' SharePoint and OneDrive storage for bulk hosting and resale.
- Storm-2990-associated phishing kits impersonate trusted organizations and brands to steal sign-in credentials, payment-card data, and verification codes; some collect data over WebSocket and send real-time notifications through Telegram.
- Downstream operators use device-code phishing to trick victims into authenticating to legitimate applications, obtaining authentication tokens and account access.
- Phishing messages use urgency and malicious links that redirect targets to attacker-controlled infrastructure. Kits also use geofencing, fake CAPTCHA gates, IP allow/deny lists, and anti-detection settings.
- Defensive Notes
- Train users to verify urgent requests directly with the purported sender or organization, rather than following links in unsolicited messages.
- Educate users to recognize phishing lures, protect personal and business information, and report reconnaissance attempts and suspicious activity.
- Use passwordless authentication and multifactor authentication; strengthen privileged accounts with phishing-resistant MFA and Conditional Access policies.
- Restrict MFA and passkey registration to trusted locations and devices, and apply least privilege and Zero Trust principles to protect Global Administrator roles and resources.
- Configure Microsoft Defender for Office 365 Safe Links for internal recipients, review Exchange Online Protection and Defender for Office 365 settings, and enable network protection to block malicious domains and content.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | jewishchoice[.]org | Domain associated with a fabricated nonprofit identity that Microsoft assesses Storm-3119 likely established to lend credibility to fraudulent tenant creation. |
MITRE ATT&CK
T1056.003 · Web Portal CapturePhishing kits collect credentials and payment information entered by targets on impersonation pages.T1078 · Valid AccountsOperators use stolen application credentials and compromised administrator accounts to access cloud tenants.T1098 · Account ManipulationUsing compromised tenant access, Storm-3119 grants privileged attributes and broad application permissions.T1098.001 · Additional Cloud CredentialsStorm-3119 self-provisions the PnP Management Shell service principal and grants it broad Microsoft Graph permissions.T1098.003 · Additional Cloud RolesStorm-3119 silently resets passwords in compromised Microsoft 365 environments.T1098.005 · Device RegistrationStorm-3119 uses stolen client secrets in an application-only authentication flow to administer compromised Microsoft 365 environments.T1497.001 · System ChecksThe kits use geofencing to restrict phishing content access to users in configured countries.T1497.003 · Time Based ChecksThe kits use fake CAPTCHA gates to impede automated browsing by threat-research tools.T1528 · Steal Application Access TokenDevice-code phishing tricks victims into authenticating to legitimate applications, allowing operators to obtain authentication tokens.T1566.002 · Spearphishing LinkStorm-2990-affiliated actors send phishing emails or messages with malicious links to phishing pages.T1567.002 · Exfiltration to Cloud StorageThe phishing kits exfiltrate collected credentials and other victim data through Telegram bot notifications.T1583.001 · DomainsStorm-3119 establishes or controls phishing domains and manages their routing and SSL certificates for customers.T1595 · Active ScanningStorm-3119 performs automated reconnaissance to identify and profile cloud-enabled organizations and tenants.
Threat Actors
Storm-2990Microsoft tracks the phishing-kit cluster and developers behind CoGUI, Haozi, and Iron Man System as Storm-2990.Storm-3119Microsoft tracks the YAM Store marketplace and its operators as Storm-3119; the group brokers compromised or fraudulently obtained cloud environments and infrastructure.
Vendors
Products
AzureYAM Store functions as an access broker, an intermediary that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses, and storage as a service to downstream operations, includingMicrosoft 365 Apps for EnterpriseYAM Store functions as an access broker, an intermediary that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses, and storage as a service to downstream operations, includingMicrosoft AuthenticatorUse the Microsoft Authenticator app for passkeys and MFA, and complement MFA with Conditional Access policies, where sign-in requests are evaluated using additional identity-driven signals.Microsoft Defender for Office 365Review our recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to ensure your organization has established essential defenses and knows how to monitor and respond to threat activity.Microsoft Defender XDRMicrosoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the activityMicrosoft Entra ID ProtectionInitial access Storm-2990-affiliated threat actors sign in to compromised accounts. Phishing campaigns use emails with malicious links. Microsoft Entra ID ProtectionMicrosoft OneDriveThe actor then abuses the compromised tenant’s SharePoint and OneDrive as bulk hosting and converts the hijacked storage into a sellable product.Microsoft Security CopilotMicrosoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, andMicrosoft SharePointread and write access to directory data and AppCatalog.ReadWrite.All, along with full control over the SharePoint API.
Tools
CoGUIthree phishing kits sold through the YAM Store that make up this Chinese-language cybercriminal network: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System.FlaskThe actor uses Flask, a lightweight Python web framework, to covertly identify and profile cloud-enabled organizations.Haozithe YAM Store that make up this Chinese-language cybercriminal network: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System.Iron Man SystemStorm-2990: The Iron Man System phishing kitPnP Management Shellthe threat actor signs in to a compromised Global Administrator account and self-provisions the PnP Management Shell service principal, which represents the actor’s application inside the compromised tenant.Telegramkits were developed by Chinese-speaking threat actors, and, despite their distinct branding and separate Telegram-based sales channels, exhibit highly similar capabilities and functionality.TorThe tooling is designed to discover Microsoft 365 tenants, assess enrollment opportunities, gather licensing and Azure cloud information, and perform these activities anonymously through Tor infrastructure.
Countries
Australiaservices, wholesale distribution, and information technology (IT) sectors in Japan, the United States, Australia, and India.ChinaThe Iron Man System phishing kit panel is predominately hosted on China-based hosting providers, with a smaller number of panels found on hosting providers in other countries.Indiadistribution, and information technology (IT) sectors in Japan, the United States, Australia, and India.Japanthe healthcare, financial services, wholesale distribution, and information technology (IT) sectors in Japan, the United States, Australia, and India.United Statesfinancial services, wholesale distribution, and information technology (IT) sectors in Japan, the United States, Australia, and India.
Industries
Financial ServicesGoogle cloud environments and related credentials, to target organizations across the healthcare, financial services, wholesale distribution, and information technology (IT) sectors in Japan, the United States,HealthcareMicrosoft or Google cloud environments and related credentials, to target organizations across the healthcare, financial services, wholesale distribution, and information technology (IT) sectors in Japan, theInformation Technologyto target organizations across the healthcare, financial services, wholesale distribution, and information technology (IT) sectors in Japan, the United States, Australia, and India.Wholesale distributionand related credentials, to target organizations across the healthcare, financial services, wholesale distribution, and information technology (IT) sectors in Japan, the United States, Australia, and India.