Global agencies dismantle YAM Store, Chinese marketplace fueling 1B phishing messages to 75k orgs
Global agencies dismantled a Chinese-language marketplace that supplied phishing kits and cloud infrastructure to criminals targeting 75,000 organizations.
Key points
- The disrupted network facilitated over 1 billion malicious messages to organizations in 150 countries.
- Investigators linked YAM Store to the Iron Man System, CoGUI, and Haozi phishing kits.
- The operation used expired domains and AI-generated fake entities to obtain cloud accounts.
Law enforcement agencies and industry partners have disrupted a massive cybercriminal ecosystem that facilitated more than one billion phishing messages. According to Microsoft, this global operation targeted over 75,000 organizations across 150 countries using stolen cloud infrastructure and sophisticated phishing kits.
Microsoft reported that the investigation began with a partnership between the company and Japan’s National Police Agency. They uncovered YAM Store, also tracked as Storm-3119, which served as an underground marketplace for cybercrime tools. The store sold compromised Microsoft and Google environments, including accounts, licenses, and storage space.
How the Network Operated
Operators acquired expired domains belonging to real organizations and rebuilt their websites to make defunct entities appear active. This allowed them to obtain legitimate cloud accounts. Another method involved using AI tools to generate fake organizations complete with documentation and content.
In compromised Microsoft environments, the operators used stolen application credentials to manage accounts. They abused SharePoint and OneDrive for hosting phishing pages. The network linked YAM Store to three specific phishing kits: CoGUI, Haozi, and Iron Man System, collectively tracked as Storm-2990.
Targeting and Tools
The Iron Man System emerged as the dominant platform by mid-2026, surpassing CoGUI which had previously targeted victims in the United States and Japan. Iron Man offers more than 2,300 templates impersonating banks, retailers, delivery services, and government agencies.
Cybersecurity firm Resecurity analyzed exposed infrastructure, including a publicly accessible Git server with 911 published builds. They identified a product-selection subsystem cataloging 2,360 phishing packages covering 130 countries. Updates to these packages continued through October 1, 2026.
What should you do?
Security teams should monitor for suspicious activity involving expired domains or unexpected changes in cloud account usage. Organizations should verify the legitimacy of delivery and payment notices before clicking links. Administrators should review application credentials and storage permissions for anomalies.
What to do and how to stay safe: Microsoft
- Monitor cloud storage and application logs for unauthorized access or unusual data movement.
- Verify the authenticity of unsolicited messages claiming to be from delivery services or banks.
- Ensure that expired domains previously owned by your organization are not being used for phishing.
- Review user permissions for cloud accounts to prevent abuse by compromised credentials.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which phishing kits were linked to the YAM Store network?
The network was linked to CoGUI, Haozi, and Iron Man System, collectively tracked as Storm-2990.
How did operators obtain legitimate cloud accounts?
They acquired expired domains of real organizations or used AI to generate fake entities with documentation.
When were the phishing packages last updated?
The phishing packages in the Iron Man System were updated through October 1, 2026.
