Microsoft and its law enforcement and cybersecurity partners announced the disruption of a vast criminal operation that enabled the sending of more than one billion malicious messages and targeted more than 75,000 organizations in 150 countries. The operation focused on the YAM Store marketplace, also known as Storm-3119, and related phishing platforms tracked by Microsoft under the names CoGUI, Haozi, and Iron Man System within Storm-2990.
The operation followed an investigation launched by Microsoft and Japan’s National Police Agency (NPA) into a wave of fraudulent activities. According to Microsoft, more than 750 million messages have targeted its customers via email and text messages since the beginning of the year, with numerous campaigns using device-code phishing to obtain authentication codes.
A Marketplace for Phishing Services, Not Just a Collection of Campaigns
The investigations revealed that YAM Store sold Microsoft and Google environments, accounts, licenses, and storage space, whether after compromising them or obtaining them through fraudulent means. The operators exploited expired domains belonging to legitimate organizations, then rebuilt their websites to make them appear active and used their identities to obtain cloud accounts.
They also created fake organizations supported by content and documents generated using artificial intelligence tools. In compromised Microsoft environments, stolen application credentials were used to manage accounts and licenses, while SharePoint and OneDrive were exploited to host phishing content.
Multiple Templates and Methods to Disrupt Analysis
The phishing groups provided lures based on traffic violations, unpaid road tolls, delivery issues, and account-verification requests. They also supported geolocation, fake CAPTCHA pages, and IP-address filtering, methods intended to conceal the infrastructure from researchers and security systems.
CoGUI targeted victims in the United States and Japan, but by mid-2026 Iron Man had become the leading platform, containing more than 2,300 templates impersonating banks, retailers, delivery services, and government entities. Resecurity, which participated in the investigation, identified a public build and container registry containing 911 published images and eight registered accounts, in addition to a product-selection system linked to the capture of card data. The catalog of phishing packages reached 2,360 packages covering 130 countries and territories, with updates through October 1, 2026.
What Changed in Practice?
Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man. Microsoft also disabled more than 20,000 accounts linked to the marketplace and blocked 100,000 domains used for impersonation and fraud.
The operation shows that modern phishing functions as a scalable services marketplace, selling infrastructure, accounts, and templates rather than relying on a single campaign. However, blocking domains and accounts does not mean the activity has ended; Microsoft said that the removal of additional infrastructure is still ongoing, while the scale of the infrastructure that has not yet been discovered remains an open question.
In addition to Microsoft and the NPA, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs participated in the investigation. In late 2024, Proofpoint had linked campaigns that persistently targeted Japan to the CoGUI group, focusing on the theft of credentials and payment data through the impersonation of well-known Japanese companies and international organizations.