Microsoft has recently disrupted a sophisticated Chinese-language phishing ecosystem, identified as Storm-3119 and Storm-2990, which has been linked to a network of phishing kit operators and infrastructure dealers. This operation, uncovered over the past year, involved the sale of tools and services that enabled cybercriminals to conduct large-scale phishing attacks targeting organizations across various sectors, including healthcare and finance, in countries such as Japan, the United States, Australia, and India.
The investigation revealed that threat actors utilized phishing kits and access to compromised cloud environments from major providers like Microsoft and Google. These tools were sold through an underground marketplace known as YAM Store, which Microsoft has tracked as part of the Storm-3119 operation. The Digital Crimes Unit (DCU) at Microsoft collaborated with law enforcement agencies globally to facilitate the disruption of this ecosystem, targeting its primary developers and infrastructure.
Mapping the Phishing Kit Ecosystem
Microsoft, in partnership with Resecurity, identified three key phishing kits sold through YAM Store: CoGUI (also known as NX or FA), Haozi (Phoenix), and Iron Man System. Collectively tracked as Storm-2990, these kits have been responsible for sending over one billion phishing emails and SMS messages to more than 75,000 organizations worldwide since January 2026. The kits are designed to impersonate legitimate brands and organizations, enabling high-volume phishing and credential theft operations.
Despite their distinct branding and separate sales channels on Telegram, the phishing kits exhibit similar capabilities, suggesting either shared development origins or close collaboration among their developers. The YAM Store marketplace accepted payments in cryptocurrencies like USDT and Ethereum, further obscuring the illicit activities associated with these operations.
YAM Store: The Access Broker
YAM Store operates as an initial access broker, selling compromised or fraudulently obtained cloud environments. The marketplace offers various infrastructure options based on age and subscription type, allowing cybercriminals to purchase seemingly legitimate resources at low costs. Storm-3119 employs automation to identify expired organization names and leverages legitimate customer information to evade detection.
During the investigation, Microsoft uncovered a five-stage attack pipeline used by Storm-3119. This pipeline includes reconnaissance of target environments, takeover of Microsoft 365 accounts, and the abuse of compromised resources for phishing operations. The actors also create fraudulent organizations to establish new tenants on Microsoft’s platform, using AI-generated content to lend credibility to their operations.
Impact and Mitigation Strategies
The interconnected nature of this phishing kit ecosystem highlights the ease with which cybercriminals can access sophisticated tools and infrastructure, lowering the barrier for entry into cybercrime. Microsoft emphasizes that the threats posed by Storm-3119 and Storm-2990 are not limited to specific sectors but could impact any organization.
To mitigate risks associated with these phishing operations, Microsoft recommends several strategies, including:
- Educating users to recognize phishing red flags and verify communications from purported senders.
- Implementing multifactor authentication (MFA) and passwordless solutions to secure accounts.
- Reviewing security settings for Microsoft services to ensure robust defenses are in place.
- Utilizing Microsoft Defender tools to monitor and respond to potential threats.
As the landscape of cybercrime continues to evolve, the disruption of the Storm-3119 and Storm-2990 operations serves as a critical reminder of the ongoing battle against phishing and cyber-enabled fraud. For further insights into the phishing infrastructure ecosystem, Microsoft provides detailed analysis and recommendations on their security blog.
For more information, refer to the original analysis on the Microsoft Security Blog here.
