Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+ organizations across multiple countries and industries. The kits used realistic brand-impersonation templates to steal passwords, payment details, and verification codes, with operators monitoring victims in real time.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Since January, one underground shop called YAM Store helped send over a billion fake login messages. You get an email: 'Action required: Your account needs verification, sign in to continue.' The link opens a perfect copy of a big-name login page, but it’s actually a YAM Store kit running on a Microsoft or Google cloud account they bought. Here’s the nasty part: the moment you type your password, payment info, or a verification code, the kit pings the buyer on Telegram in real time, so they can jump into your account before you even close the tab. If any email or text tells you to 'verify' by clicking a link, don’t. Open the official app or type the site address yourself and sign in there instead.
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
