Microsoft has disrupted the YAM Store, a massive fraud network powered by the CoGUI, Haozi, and Iron Man System tools.
The operation, which Microsoft tracks as Storm-2990, facilitated over one billion fraudulent messages since early 2026, utilizing extensive brand-impersonation templates to target 75,000 organizations.
The tools allowed operators to track victim inputs in real time, demonstrating the scale of automated abuse targeting enterprise sectors like finance and IT.
The YAM Store market
The perpetrators had created an illegal digital marketplace called YAM Store. There, interested parties could purchase three specialized tools for their scams: CoGUI, Haozi, and Iron Man System. The latter even had over 2.300 ready-made templates that imitated well-known brands.
Since January 2026, the network has facilitated the sending of more than a billion fraudulent messages, including emails and SMS messages. These messages impersonated well-known companies, such as Amazon, Apple, and PayPal, in order to mislead recipients. The attacks affected more than 75.000 organizations in more than 150 countries, with the main targets being businesses in the healthcare, finance, IT, and distribution sectors.
How did the circuit work?
The perpetrators used automated methods to identify and gain control of inactive corporate accounts. They then leveraged this infrastructure to host their scam pages, making them appear more trustworthy in the eyes of victims.
READ ALSO
Flock: Cameras that monitor drivers in the US at the center of reactions
The tools they provided allowed the fraudsters to monitor in real time the information users entered on the fake websites. For their transactions on the YAM Store, the perpetrators used cryptocurrencies, such as Ethereum and USDT, to make them difficult to track.
The beginning of the investigation
The investigation was initiated by Microsoft in late 2025, following reports of scams in Japan. As part of the operation, Microsoft experts tracked the creators of the tools, which they named Storm-2990, and the YAM Store marketplace, which they identified as Storm-3119. While disabling these tools is an important step, the investigation into the broader activities of these types of networks is still ongoing.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)