Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax problems) to trick people into clicking links, sharing information, or paying. Microsoft says the operation also stole credentials and financial data and abused device-code sign-ins to gain account access.
Microsoft tracks this phishing-kit cluster as Storm-2990. According to Microsoft, the ecosystem delivered more than 1 billion phishing emails and SMS messages to more than 75,000 organizations worldwide. The campaigns relied on template-based kits that impersonated legitimate brands at scale, allowing operators to reuse the same proven lures across countless targets rather than crafting unique messages each time.
The lures followed a consistent pattern: an urgent notification claiming a package could not be delivered, a toll was unpaid, a bank account needed attention, or a tax bill was overdue. Each message pushed the recipient toward the same outcome, clicking a link, sharing personal information, or making a payment. Once a target engaged, Microsoft said attackers stole credentials and financial data, and in some cases abused the device code authentication process to obtain authentication tokens and access compromised accounts.
The operation succeeded through sheer volume and repetition rather than complexity. Resecurity found 2,360 phishing templates impersonating a wide range of organizations, including banks, retailers, healthcare providers, transportation authorities, police departments, and government agencies, across many countries. With that many templates in circulation, employees in any industry, from finance to healthcare administration to logistics, were likely to encounter a message that matched something familiar in their daily routine.
The urgency built into every lure also short-circuited careful thinking. A message claiming an account needs attention or a toll is overdue is designed to make someone act fast rather than verify slowly. Because the messages arrived relentlessly, deleting or blocking one often just meant another would follow shortly after.
Organizations can reduce exposure by training employees, especially in finance, procurement, helpdesk, and administrative roles, to treat urgent problem alerts as a trigger for verification, not immediate action. Staff should be encouraged to navigate directly to an official site or app rather than clicking a link in a text or email, and to report suspicious messages even if they seem minor.
Because credential theft was a central goal of this operation, reinforcing that passwords and payment details should never be entered through a link in an unsolicited message is essential. Given the scale and repetition described in this case, awareness training should also set the expectation that these scams are part of larger, organized campaigns rather than isolated incidents, and that consistent verification habits matter more than reacting to any single message.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Storm-2990 is the name Microsoft uses to track a Chinese-speaking phishing-kit cluster that delivered more than 1 billion phishing emails and SMS messages to over 75,000 organizations globally.
The campaigns used urgent alerts about delivery failures, unpaid tolls, bank account issues, and overdue tax bills to push recipients to click links, share information, or make payments.
Microsoft said attackers stole credentials and financial data, and abused the device code authentication process to obtain authentication tokens and access compromised accounts.
Microsoft and partners seized or redirected domains supporting the kit services, disabled more than 20,000 accounts, and blocked more than 100,000 domains used for impersonation and fraud.
That text saying, “Suspicious alert: a package cannot be delivered”? It might be part of a billion-message scam Microsoft just took down. Microsoft calls this phishing kit network Storm-2990. It blasted more than 1 billion fake delivery, unpaid toll, and bank problem messages at over 75,000 organizations to steal logins and payment data. Here’s the trick: you get a text like “Suspicious alert: a toll remains unpaid.” The link opens an official-looking site that asks you to sign in or pay. The details change, but the goal is always the same, get you to click and hand over passwords or money. If you get any urgent delivery, toll, bank, or tax text, don’t tap the link, open the official app or type the site address yourself and check there instead.
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
