Microsoft Details Yam Store Phishing Ecosystem Behind More Than 1 Billion Messages
Summary
Microsoft says a phishing ecosystem linked to Yam Store facilitated more than 1 billion emails and SMS messages to over 75,000 organizations since January 2026. It disabled more than 20,000 associated tenants.
Key points
- Microsoft tracks Yam Store as Storm-3119 and describes it as a marketplace for phishing kits and infrastructure, including fraudulently obtained or compromised Microsoft and Google cloud environments.
- Microsoft and Resecurity identified the CoGUI, Haozi (also called Phoenix), and Iron Man System kits in the ecosystem.
- Microsoft says kit operators facilitated more than 1 billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
- Iron Man System reportedly includes over 2,335 templates tailored to more than 139 countries and uses techniques such as geofencing, fake CAPTCHA gates, and IP address lists.
- Microsoft says it disabled more than 20,000 connected tenants associated with over 140,000 malicious domains and strengthened safeguards against fraudulent accounts.
- Microsoft recommends educating users about phishing, filtering unsolicited communications, and verifying requests through independently obtained contact details.
Article Details
- Event Type
- Microsoft-reported disruption and investigation of a large-scale phishing ecosystem involving phishing-kit developers, infrastructure sellers, and their customers.
- Impact
- Microsoft said the kit operators facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations since January 2026. Yam Store was associated with over 140,000 malicious domains, and Microsoft said it disabled more than 20,000 connected tenants. The campaigns sought sensitive information, including credentials and verification codes.
MITRE ATT&CK
People
Threat Actors
Storm-2990Microsoft's tracking name for developers behind the CoGUI, Haozi, and Iron Man System phishing kits and surrounding activity.Storm-3119Microsoft's tracking name for the Yam Store infrastructure broker, which sold phishing tools and infrastructure built on compromised or fraudulently obtained cloud environments.
Vendors
Googleas Storm-3119. Yam Store offered multiple phishing kits for sale and, perhaps most novel, Microsoft and Google domains associated with legitimate, expired, or previously used organizations, which allowed threatMicrosoftMicrosoft Threat Intelligence and Microsoft Digital Crimes Unit today published research concerning a cybercrime ecosystem dedicated to the tools and infrastructure needed to support phishing campaigns. The researchResecurityMicrosoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System.
Products
CoGUIMicrosoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System.HaoziMicrosoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System.Iron Man SystemMicrosoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System.PhoenixMicrosoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System.
Tools
Countries
Australiasaid the Iron Man System includes more than "2,335 templates tailored to over 139 countries including Australia, Japan, India, and the United States, with the United States accounting for the most phishingIndiaMan System includes more than "2,335 templates tailored to over 139 countries including Australia, Japan, India, and the United States, with the United States accounting for the most phishing templates." Lures mimicJapanIron Man System includes more than "2,335 templates tailored to over 139 countries including Australia, Japan, India, and the United States, with the United States accounting for the most phishing templates." LuresUnited Statesmore than "2,335 templates tailored to over 139 countries including Australia, Japan, India, and the United States, with the United States accounting for the most phishing templates." Lures mimic various trusted
Industries
financemimic various trusted brands and organizations including local government, law enforcement, healthcare, finance, transportation, and retail.HealthcareLures mimic various trusted brands and organizations including local government, law enforcement, healthcare, finance, transportation, and retail.Retailand organizations including local government, law enforcement, healthcare, finance, transportation, and retail.Transportationtrusted brands and organizations including local government, law enforcement, healthcare, finance, transportation, and retail.