Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

What it is

YAM Store (Microsoft's Storm-3119) is an access broker that hijacks Microsoft 365 and Azure for Education tenants and resells the accounts, licenses and storage. It also sold the Storm-2990 phishing kits CoGUI, Haozi and Iron Man. Microsoft assesses with high confidence that Chinese-speaking actors developed the kits. It cites shared infrastructure and overlapping activity, which suggest shared origins, code reuse or close collaboration.

What the page adds beyond the summary

• Origin: Japan's National Police Agency flagged the campaigns in late 2025. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined.
• Scale against Microsoft customers: more than 750 million of the 1B+ messages were aimed at Microsoft customers. The operators made tens of millions of dollars.
• Healthcare: Health-ISAC joined the suit because actors frequently used this infrastructure against hospitals and healthcare organizations.
• Kit turnover: CoGUI was heavily used against Japan and the US, but by mid-2026 Iron Man was replacing it. YAM Store began advertising Iron Man in June 2026.
• Lure themes: Iron Man has templates for 139+ countries, per Microsoft. The US has the most, and most US lures impersonate transportation and government bodies, such as traffic and parking-fee authorities.
• Buyer choice: YAM Store buyers could select tenants by age, subscription type and environment type, such as education or nonprofit.

How it works

The kits are live, interactive platforms rather than static pages. Operators watch victims in real time and prompt them for one-time verification codes. Resecurity bought an Iron Man license and ran it in an isolated lab. It counted 2,360 templates across 130 countries and areas, the newest added October 1. The panel must contact the vendor's licensing server regularly to function.

What to do

• Awareness and detection: prioritize user awareness and detection around traffic, parking and government-fee lures. Treat OTP codes as phishable by these kits.
• Takedown work: for defenders doing infrastructure takedown, Resecurity notes that disabling or sinkholing the licensing authorization host would degrade every active Iron Man deployment. The page gives no hostname or other indicators.

Caveats

• The seizure covers only part of the network. Microsoft says YAM Store, CoGUI and Iron Man are "only part of that larger criminal network".
• Template counts differ between sources: Microsoft reports 2,335+ and Resecurity 2,360.
• The page publishes no IOCs, detection queries or configuration guidance.