Expired Domains, Live Brand: The Asset-Lifecycle Gap Behind Yam Store

Microsoft and Japanese police spent months unravelling a phishing network that its operators had assembled from other people's abandoned property. The detail worth keeping is not the volume of email. It is the sourcing method: the Yam Store marketplace, tracked by Microsoft as Storm-3119, looked for internet domains that legitimate organizations had allowed to expire, rebuilt the sites so those organizations appeared active, and used the revived identity to obtain Microsoft 365 accounts for resale.

That sequence turns routine back-office work into an initial access step. A lapsed registration is not a filing problem once someone else controls the namespace that customers, partners and identity providers still associate with your brand.

What the operation actually did

Microsoft's write-ups describe two related businesses. Storm-3119 ran Yam Store, an underground marketplace that sold fraudulently obtained or compromised Microsoft and Google domains alongside hijacked accounts, licences and storage. Storm-2990 covers the phishing kits sold through the same storefront: CoGUI (also called NX or FA), Haozi (also called Phoenix) and Iron Man System.

The kits impersonated organizations across several verticals to harvest usernames, passwords and payment card data. Lures covered unpaid tolls and traffic fines, parcel delivery, bank and government impersonation and fake login pages. Microsoft also described fake organizations, likely built with AI-generated content and forged documents, used to establish Microsoft tenants from scratch.

Scale on the email side was large: the kits were behind more than a billion phishing emails and texts sent to over 75,000 organizations since January 2026, targeting healthcare, financial services, wholesale distribution and IT in Japan, the United States, Australia and India. Microsoft says it has disabled more than 20,000 accounts connected to Yam Store and blocked more than 100,000 domains used for impersonation and fraud.

Why an expired domain is a working credential

An abandoned domain keeps three things that attackers cannot buy cheaply: history, reputation and inbound links. Mail filters, certificate authorities and customers treat an aged domain differently from a week-old lookalike. When the registration lapses, the trust does not.

External observation is the practical control that remains available after the registrar has released the name. On 20 October 2026, a ZoomEye search for the generic Microsoft sign-in page title across domain assets returned 2,507 matches:

title="Sign in to your account" && is_domain=true

Narrowing the same dork to Japan returned 46 domain assets, and to the United States 1,667. Those figures describe how many web properties currently present that page title. They say nothing about ownership, intent or whether any of them belongs to a revived expired domain.

Reading the numbers correctly

The honest reading is narrow. A count of sign-in pages is an inventory measurement, not an incident count. The same title appears on genuine tenants, test systems, abandoned marketing sites and malicious infrastructure. High counts in a country with heavy cloud adoption are expected. A low count in Japan reflects the size of that market's indexed footprint, not the absence of targeting; Microsoft named Japan first among affected countries.

What the numbers do support is a prioritization habit. If an organization knows which page titles its own login portals use, it can ask a search engine how many other domains present the same title, then narrow by certificate subject, hosting ASN or geography. On the same date, a certificate-content query returned 116,243 domain assets:

ssl="microsoft" && is_domain=true

That number is dominated by legitimate Microsoft infrastructure and partner services. It is a demonstration of why certificate text alone is a weak signal and why title, certificate and hosting evidence should be combined before anyone acts.

The controls that would have changed the outcome

Domain expiry governance is unglamorous and effective in practice. Registrations for brands, product names and historical campaign domains belong in a tracked inventory with auto-renew, registrar lock and at least two named owners. Decommissioned domains should be retired deliberately: keep the registration, publish a redirect, or hand the name to legal review before release.

Monitoring should cover the gap between expiry and reuse. Certificate transparency logs and DNS records for the organization's own names will show a new operator quickly. Search engines can reveal what the resurrected site now displays.

Tenant creation is the second surface. Microsoft's account of fabricated organizations suggests that external parties can build a plausible Microsoft 365 tenant with forged paperwork. Verification of new tenants that claim a brand or a business relationship is a control, not paperwork.

Limitations

Neither Microsoft write-up states how many organizations were actually compromised, how many consumers were affected, or how many of the blocked 100,000 domains were live at any moment. The ZoomEye counts here are single observations taken on one day with a stated dork and are not a measurement of Yam Store infrastructure. Treat all three as separate evidence classes.

References

[1] Infosecurity Magazine, "Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages": https://www.infosecurity-magazine.com/news/microsoft-yam-store-one-billion/

[2] Microsoft Security Blog, "The hidden network inside the phishing infrastructure ecosystem powering global cybercrime": https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/

[3] Microsoft On the Issues, "Disrupting the service economy behind transnational cybercrime operations": https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/