As reported by The Hacker News, Microsoft's court-authorized disruption of three phishing kits — CoGUI (aka NX/FA), Haozi (aka Phoenix), and Iron Man System — has exposed the industrial scale of a Chinese-language cybercriminal ecosystem that pumped over one billion phishing messages into 75,000+ organizations across 150 countries since January 2026 alone. While the takedown is a significant win, the structural intelligence that emerged from it deserves closer attention from defenders.

Threat Alert: Microsoft identifies a centralized marketplace, tracked as Storm-3119 (YAM Store), functioning as an illicit Amazon for phishing operations: distributing kits, selling compromised Microsoft and Google cloud environments, and processing cryptocurrency payments in USDT and Ethereum.

Why This Matters Beyond the Takedown

What makes this operation notable isn't just the volume — it's the supply chain maturity it reveals. Microsoft identifies a centralized marketplace, tracked as Storm-3119 (YAM Store), functioning as an illicit Amazon for phishing operations: distributing kits, selling compromised Microsoft and Google cloud environments, and processing cryptocurrency payments in USDT and Ethereum. The developers behind all three kits are tracked as Storm-2990, and Microsoft notes significant overlap in capabilities and infrastructure, pointing to shared codebases or close developer collaboration.

This is no longer a collection of independent operators — it's a vertically integrated criminal economy with developers, distributors, infrastructure brokers, and end-stage threat actors all transacting through a unified marketplace.

The implication is sobering: disrupting three kits does not dismantle the marketplace that spawned them. YAM Store continues to represent a structural threat, and replacement kits will likely surface within weeks or months, potentially reusing the same compromised cloud infrastructure that remains in circulation.

The Compromised Cloud Angle

One of the most critical details in Microsoft's findings is that threat actors purchased access to compromised or fraudulently obtained Microsoft and Google cloud environments through YAM Store to launch these campaigns. This means legitimate cloud tenants — potentially yours — were used as the sending infrastructure for over a billion phishing messages. Organizations whose tenants were compromised may face deliverability damage, reputation blacklisting, and potential downstream liability without ever knowing they participated in the attack chain.

Who Is Most at Risk

The Compromised Cloud Angle
Healthcare organizations — specifically targeted by these campaigns, likely due to credential value for insurance fraud and data exfiltration
Financial institutions — primary lure category across the campaigns, with realistic banking and payment portal templates
Organizations with under-monitored Microsoft 365 or Google Workspace tenants — the infrastructure layer being quietly weaponized
Enterprises in Japan, the U.S., Australia, and India — the top targeted geographies identified by Microsoft

Shield53 Recommendations

Immediate Actions

  • Audit tenant forwarding rules and send connectors — compromised Microsoft 365 environments were used as phishing infrastructure. Check for newly created transport rules, SMTP relay connectors, or OAuth app registrations you don't recognize.
  • Review DMARC enforcement posture — if your domain isn't at p=reject, spoofed messages using your brand are more likely to reach targets. This is the time to close that gap.
  • Hunt for YAM Store IOCs — work with your threat intelligence provider to integrate indicators from this disruption into email security, SIEM, and EDR platforms. Microsoft's Digital Crimes Unit will be publishing updated IOC packages.

Strategic Hardening

  • Implement conditional access policies that block authentication from anomalous geographies and require MFA for all admin and mail-enabled accounts. The compromised tenants used in these campaigns almost certainly lacked robust access controls.
  • Monitor outbound email volume anomalies — a sudden spike in outbound messages from a single mailbox or service account is a leading indicator of tenant compromise. Set automated alerts.
  • Brief finance and procurement teams on USDT/Ethereum payment patterns — YAM Store's cryptocurrency payment model means follow-on fraud may surface as unusual crypto transactions in expense or vendor systems.
  • Engage with Health-ISAC or your sector ISAC for the latest IOC feeds and collaborative threat intelligence from this disruption operation.

Broader Implications

The Storm-2990/Storm-3119 ecosystem demonstrates that phishing-as-a-service has reached the same level of operational maturity we've seen in ransomware-as-a-service. The marketplace model — with specialized developers, infrastructure brokers, and end-user operators — means takedowns will produce temporary displacement rather than permanent degradation unless the marketplace infrastructure itself is dismantled. Expect Microsoft's next legal actions to target YAM Store directly, and expect the threat actors to migrate to alternative platforms in the meantime.

Defenders should treat this not as a resolved incident but as a intelligence windfall. The IOCs, infrastructure patterns, and TTPs exposed through this operation will remain valid for detection engineering long after the kits themselves go offline.