Microsoft uncovered a Chinese-language criminal ecosystem operating as an integrated marketplace for phishing services, linking phishing-kit developers, infrastructure sellers, and attackers who purchase these services to conduct large-scale campaigns. The company said entities linked to this ecosystem facilitated the delivery of more than one billion email and text messages to more than 75,000 organizations worldwide since January 2026.
The campaigns targeted organizations in the healthcare, financial services, wholesale distribution, and information technology sectors, with victims identified in Japan, the United States, Australia, and India. In cooperation with law enforcement agencies and other partners, Microsoft's Digital Crimes Unit helped disrupt the ecosystem's key developers and core infrastructure.
A Marketplace Selling Access and Infrastructure
Microsoft tracked the illicit marketplace under the name Storm-3119. It operates according to an initial access broker model under the name YAM Store. The marketplace sells compromised or fraudulently obtained Microsoft and Google environments, including accounts, licenses, storage, and domains that appear to be associated with real or former organizations.
According to the investigation, operators use automated tools to identify exploitable cloud environments, then take over Microsoft 365 and Azure for Education tenants and manage them through dashboards built with PHP, Java/Spring, and Cloudflare Workers technologies. This access allows them to reset passwords, assign educational licenses, grant elevated permissions, and then convert SharePoint and OneDrive into hosting resources for sale.
The ecosystem also provides domain management, SSL certificates, and website routing through Cloudflare, and sells resources through an automated interface that accepts payments via Alipay, WeChat Pay, and USDT. Microsoft noted that the operators also created fictitious organizations and supporting websites to obtain new tenants, potentially using AI-generated content and forged documents.
Phishing Kits as a Service
Microsoft identified three phishing kits sold through the YAM Store: CoGUI, also known as NX or FA; Haozi, known as Phoenix; and Iron Man System. The company tracks the developers and activity associated with these kits under the name Storm-2990.
Iron Man System contains more than 2,335 templates customized for more than 139 countries, impersonating government, financial, healthcare, law enforcement, transportation, and retail brands and entities. The platform supports location-based content restrictions, fake CAPTCHA pages, IP address block and allow lists, and settings designed to evade detection.
The platform also sends real-time notifications through Telegram when a victim enters login credentials, card details, or verification codes. The kit collects data through WebSocket, allowing the operator to monitor the victim's interaction and manually control the next step. Microsoft says these capabilities make the kits more like multi-tenant commercial phishing products than standalone tools used by a single attacker.
What Changes in Practice?
The findings show that modern phishing relies on a distributed services economy: one party provides accounts and storage, another develops the templates, and buyers conduct the final campaigns. This division lowers the barrier to entry for less experienced attackers and makes the abuse of legitimate cloud environments part of a criminal supply chain that is difficult to connect to a single campaign.
Microsoft observed that subsequent activity included credential theft, phishing through the device code flow to obtain access tokens, and financial fraud using stolen payment data. It therefore recommends that organizations train users to recognize signs of urgency and unexpected links, implement phishing-resistant multifactor authentication or passkeys, and restrict Global Administrator permissions according to the principles of least privilege and Zero Trust.
Other measures include reviewing Exchange Online Protection and Microsoft Defender for Office 365 settings, enabling Safe Links for internal recipients, limiting the registration of authentication methods to trusted locations and devices, and enabling network protection to prevent access to malicious domains and content. The figures and assessments in the report remain based on Microsoft's observations, while the source did not clarify the scope of the detailed legal actions or how long the disruption lasted.