The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

What it is

Microsoft Threat Intelligence's write-up of two linked clusters. Storm-3119 (YAM Store) brokers hijacked or fraudulently created Microsoft and Google tenants. Storm-2990 develops the CoGUI (aka NX/FA), Haozi (aka Phoenix) and Iron Man System phishing kits, which YAM Store also sells. Iron Man System was advertised from June 2026. Microsoft says the kits sent over one billion emails and SMS messages to over 75,000 organizations since January 2026.

How it works

Details in the broker pipeline that matter for defenders:

• Tenant sourcing: Storm-3119 automates the discovery of expired environment or organization names and reuses the legitimate customer information tied to them to get past existing detections. It also creates fraudulent organizations with likely AI-generated content and forged documents. One example was a fake nonprofit tenant tied to a freshly registered .org domain.
• Persistence: with a compromised tenant's client secret, admin panels use an application-only flow. They reset passwords silently (no forced change at next sign-in), assign education licenses and grant privileged attributes. Microsoft says app-level access is more durable and harder to detect than user-session access.
• Storage abuse: from a compromised Global Administrator account, the actor self-provisions the PnP Management Shell service principal. It grants itself broad Graph permissions, including directory read/write and AppCatalog.ReadWrite.All, plus full control of the SharePoint API. SharePoint and OneDrive then become bulk hosting that is resold.
• Kit operation: Iron Man System is a multi-tenant Go (GoFrame) panel, mostly on China-based hosts. The license server domain is hard-coded into the kit. Operators watch victims live through WebSocket and Telegram notifications, including card data and verification codes, and steer what the victim sees next.

Preconditions / Affected

• Education (.edu) and nonprofit-style tenants, and expired or lapsed organization names, are the supply side.
• Downstream victims seen were in healthcare, financial services, wholesale distribution and IT, in Japan, the US, Australia and India. Microsoft says the techniques could hit any organization.
• US lures are mostly transportation or government themed, such as tolls and traffic or parking fines.

What to do

The page's guidance, with the items most specific to this campaign first:

• Lock down Global Administrator roles with least privilege and Zero Trust, because Storm-3119 was observed obtaining that access.
• Require phishing-resistant MFA for privileged accounts through Conditional Access.
• Allow passkey and MFA registration only from trusted locations and devices.
• Apply Defender for Office 365 Safe Links to internal recipients.
• Enable network protection to block malicious domains.
• Train users that sign-in prompts should name the application. Azure has shown a Cancel/Continue confirmation since 2021, and phishing sign-ins often lack it. This matters for the device-code phishing seen downstream.

Caveats

• The post gives no IOCs, hunting queries or tenant-audit steps. The service principal and permission names above are the only concrete hunting leads. The Defender detection list and the threat analytics reports are referenced but not reproduced in the page text.
• The Defender coverage applies only to downstream activity seen on Storm-2990 infrastructure, not to the broker pipeline.
• Microsoft says the ecosystem extends beyond Microsoft services, but gives no detail on other providers.