As reported by BleepingComputer, a coordinated global law enforcement operation has disrupted a sprawling cybercriminal ecosystem responsible for over a billion malicious messages targeting more than 75,000 organizations across 150 countries. The investigation, led by Microsoft and Japan's National Police Agency with support from Resecurity, uncovered a layered infrastructure involving the YAM Store marketplace (tracked as Storm-3119) and multiple phishing kits — CoGUI, Haozi, and the Iron Man System — collectively tracked as Storm-2990.

Threat Alert: As reported by BleepingComputer, a coordinated global law enforcement operation has disrupted a sprawling cybercriminal ecosystem responsible for over a billion malicious messages targeting more than 75,000 organizations across 150 countries.

This takedown matters not because phishing is new, but because of what the infrastructure reveals about the industrialization of social engineering. The ecosystem operated as a full-service supply chain: YAM Store sold pre-compromised Microsoft and Google environments, fraudulently obtained cloud licenses, and abused SharePoint and OneDrive for hosting. The Iron Man kit alone offered over 2,300 impersonation templates spanning 130 countries. This is phishing-as-a-service at a scale that rivals legitimate SaaS platforms.

Three Patterns Defenders Should Note

1. AI-Generated Organizational Fraud

Perhaps the most significant detail is that operators used AI tools to generate fake organizations — complete with content, documentation, and web presence — to fraudulently obtain cloud accounts and licenses. This shifts the trust boundary. Identity verification processes at cloud providers are being gamed by synthetic entities that look legitimate on paper. Defenders can no longer assume that a sender domain with a plausible corporate footprint is authentic.

2. Cloud Infrastructure as Phishing Host

The abuse of SharePoint and OneDrive for hosting phishing content is particularly insidious. Malicious links pointing to *.sharepoint.com or *.onedrive.com domains inherently bypass many URL reputation filters and email security gateways that trust Microsoft infrastructure by default. This is not a new tactic, but the volume described here suggests it has become a core delivery method.

Key insight: When attackers host payloads inside the same ecosystem your organization relies on for productivity, perimeter-based detection loses meaningful signal.

3. Device-Code Phishing at Scale

Microsoft confirmed that many of the 750+ million messages targeting Microsoft 365 customers used device-code phishing to obtain authentication tokens. This technique bypasses MFA because it exploits the OAuth device flow — designed for input-constrained devices — by tricking users into entering a code at a legitimate Microsoft login page. Once the user completes the flow, the attacker receives a valid refresh token. No password required, and MFA is satisfied by the victim's own action.

Who Is Most at Risk

Who Is Most at Risk
Organizations heavily reliant on Microsoft 365 and Google Workspace — the primary targets of this ecosystem
Mid-size enterprises (500–5,000 employees) — large enough to have valuable cloud tenants but often lacking advanced detection capabilities
Organizations in the US and Japan — explicitly named as primary CoGUI targets
Any organization using device-code flow — including those with IoT, print management, or legacy integrations that depend on it

Shield53 Recommendations

Immediate Actions:

  • Audit device-code flow usage: Review Microsoft Entra ID sign-in logs for device-code authentication (authenticationProtocol = deviceCode). Flag any device-code sign-ins from unexpected locations or IP ranges. Where device-code flow is not required, consider restricting it via Conditional Access policies.
  • Tighten cloud storage sharing: Review external sharing settings on SharePoint sites and OneDrive accounts. Disable anonymous links where possible and enforce expiration policies on all shared links.
  • Deploy detection for illegitimate tenant creation: Monitor for newly created Microsoft tenants or Google Workspace instances that interact with your environment — especially those with recently registered domains or sparse activity histories.
  • Implement sender identity hardening: Enforce DMARC at p=reject and verify that your email security gateway does not blanket-trust Microsoft-owned infrastructure for internal-origin messages.

Strategic Actions:

  • Invest in identity-based anomaly detection that analyzes sign-in patterns across OAuth flows, not just password-based authentication
  • Train helpdesk and security teams to recognize device-code phishing — users will report being asked to enter a code at a Microsoft page, which looks entirely legitimate
  • Develop a takedown response playbook: when a phishing campaign is found hosted on legitimate cloud infrastructure, have a documented process for escalating to the platform provider (Microsoft, Google) rather than attempting to block the domain

The broader implication here is that the line between compromised infrastructure and legitimately provisioned but fraudulent infrastructure is blurring. Attackers are no longer just breaking into environments — they are building their own, complete with AI-generated corporate identities, and using them to launch campaigns at billion-message scale. The defensive posture must shift accordingly: from detecting malicious content to detecting malicious context.