Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to target healthcare organizations. The phishing kits supported country-specific impersonation lures and real-time credential harvesting, including prompts for one-time verification codes.
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem made up of three linked services: YAM Store, CoGUI, and Iron Man. Together these services were used to send more than one billion malicious messages since January 2026, targeting consumers and over 75,000 organizations across more than 150 countries. YAM Store, tracked as Storm-3119, operated as an access broker, hijacking Microsoft 365 and Azure tenants and reselling stolen accounts to other criminal groups, including operators behind kits tracked as Storm-2990. Iron Man supplied thousands of localized templates, with US-focused lures commonly impersonating transportation or government authorities referencing unpaid traffic or parking fees.
The phishing kits went beyond static, one-time emails. They functioned as live, interactive platforms for credential harvesting, letting operators monitor victims in real time as they entered information. This allowed attackers to prompt victims for one-time verification codes during the sign-in flow, effectively relaying stolen credentials and codes before a victim could realize the page was fraudulent. Because the underlying infrastructure supported thousands of country-specific templates, messages could be tailored to look locally relevant and legitimate, increasing the odds a recipient would click and comply.
Organizations, particularly in healthcare, should treat unexpected fee or payment notices as high risk and train staff to verify independently through official channels rather than clicking embedded links. Staff should be reminded that one-time verification codes should never be entered on a page reached from a message link, instead relying on normal, trusted sign-in paths. Because these kits support thousands of localized templates across many countries, awareness training should emphasize that highly polished, locally tailored messages are not proof of legitimacy. Quick reporting of suspicious messages remains one of the most effective defenses against large-scale phishing infrastructure like this.
Techniques referenced in this campaign align with MITRE ATT&CK entries such as T1566.002 for spearphishing links and T1078 for valid accounts obtained through credential theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
YAM Store was a Chinese-language cybercrime service tracked as Storm-3119 that acted as an access broker, reselling stolen Microsoft 365 and Azure tenants and enabling downstream phishing kits like Storm-2990.
Health-ISAC joined because threat actors frequently used this infrastructure to target hospitals and healthcare organizations, making healthcare a recurring target of the campaigns.
The kits functioned as live, interactive platforms for credential harvesting, allowing operators to monitor victims in real time and prompt them for one-time verification codes.
Most US lures impersonated transportation and government entities, such as authorities handling traffic and parking fees, to create urgency and prompt clicks.
You get an email: “Unpaid parking fee – pay now to avoid penalties.” Looks local, looks official… and it’s part of a billion-message phishing bazaar. Behind that one email is a marketplace Microsoft just hit: YAM Store, CoGUI, Iron Man. They pumped out over one billion phishing messages, selling stolen Microsoft 365 accounts and fake login pages tailored to your country and city. Here’s the nasty part: you click, land on a perfect-looking Microsoft or government sign-in page, enter your password… and then it asks for your one-time verification code. Those kits run live, so someone is watching in real time and draining your account the moment you type it. Your move is simple: if a message sends you to a page that asks for a one-time code, stop. Close it, open our normal app or typed URL instead, sign in there, and report that message.
Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
