YAM Store phishing market disrupted after 1 billion messages
Microsoft and partners seize domains behind CoGUI, Haozi, and Iron Man kits

YAM Store phishing market disrupted after 1 billion messages

Microsoft and partners disrupted a Chinese-language phishing-kit market that has been feeding large credential-theft campaigns all year. Since January 2026, kits sold through YAM Store helped send more than one billion phishing emails and SMS messages to more than 75,000 organizations.

What happened

Microsoft tracks the marketplace as Storm-3119 and the kit developers as Storm-2990. The three kits are CoGUI (also called NX or FA), Haozi (also called Phoenix), and Iron Man System. They impersonate government, finance, and logistics brands, and they steal passwords and payment-card data. Many of the Microsoft 365 lures used device-code phishing to collect authentication tokens rather than just passwords.

YAM Store is an access broker, not only a kit shop. Microsoft says it hijacks or fraudulently creates Microsoft 365 and Google cloud tenants, including education and nonprofit-looking environments, then resells accounts, licenses, and storage. One fabricated nonprofit, "Jewish Choice," was stood up so buyers could send mail from a fresh .org domain. Payment ran through crypto, including USDT, plus Alipay and WeChat Pay.

On 14 October, under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man. Microsoft also deactivated more than 20,000 related accounts and blocked 100,000 domains used for impersonation. Japan's National Police Agency was part of the investigation. This is a disruption, not a permanent shutdown of every reseller.

Who is affected

Microsoft says the heaviest targeting hit healthcare, financial services, wholesale distribution, and IT in Japan, the United States, Australia, and India. Any organization whose users accept device-code prompts, or whose Microsoft 365 tenant could be enrolled with stolen or expired organization details, is in the blast radius. South African MSPs with Microsoft 365 customers should assume the same kits are sold globally.

What to do now

Review Microsoft 365 tenants for unexpected enterprise applications, app-only admin consent, and newly created Global Admin or education-license assignments. Device-code phishing does not need a password reset to succeed if the user approves a code. Block or restrict the device-code flow where the business does not need it. Watch for mail sent from freshly registered lookalike domains and from tenants that do not match the brand in the message.

  • Audit enterprise apps and app-only credentials added since January, especially Graph and SharePoint write permissions.
  • Disable device-code authentication unless a documented workflow needs it.
  • Alert on impossible-travel token use and on mailbox rules created minutes after a new sign-in.
  • Treat a seized-domain notice as a reason to reset sessions, not as proof the campaign is over.

Source: Microsoft Security Blog, with seizure details reported by BleepingComputer. The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Ivanti Connect Secure CVE-2026-104935 exploited for root access
Unauthenticated command execution on Connect Secure, CISA due 16 October