Microsoft and a group of partners have disrupted a cybercrime marketplace and three phishing kits linked to more than 1 billion scam emails and text messages this year. The operation was announced on October 14, 2026 and carried out under an order from a US federal court in Florida. Microsoft disabled more than 20,000 accounts and blocked more than 100,000 domains. The kits were rented out as a service, which let people with little skill run large phishing campaigns.
What was taken down
According to Microsoft's announcement, the targets were a marketplace called YAM Store and three phishing kits: CoGUI, Haozi and Iron Man. A phishing kit is ready-made software for building fake login pages and sending the lures that point to them.
Microsoft tracks YAM Store as Storm-3119 and the kit developers as Storm-2990. It says with high confidence that Chinese-speaking actors built the kits.
YAM Store sold access to Microsoft 365 and Azure for Education tenants, Microsoft and Google environments, licenses, storage and credentials. Some operators bought expired nonprofit and education domains to obtain Microsoft 365 accounts for resale, TRM Labs reports.
The scale
| Measure | Figure |
|---|---|
| Phishing emails and texts sent since January 2026 | More than 1 billion |
| Messages aimed at Microsoft customers | More than 750 million |
| Organizations targeted | More than 75,000 |
| Countries | More than 150 |
| Accounts Microsoft disabled | More than 20,000 |
| Domains Microsoft blocked | More than 100,000 |
The Hacker News reports that the three kits used about 17,000 unique domains.
How the kits worked
The Iron Man kit offered more than 2,335 templates covering more than 139 countries, Microsoft says. It impersonated government agencies, including traffic and parking authorities, as well as banks, healthcare providers, retailers and streaming services.
The kits used several tricks to avoid detection:
- Fake CAPTCHA pages that block automated security scanners.
- Location filters and IP lists that show the scam only to intended targets.
- Telegram alerts that notify the operator when a victim enters details.
- Live sessions that let operators interact with a victim in real time.
They harvested login details and payment card data. In some cases, attackers abused device code sign-in to steal access tokens. That is a login flow where a user types a short code on a second device.
How the case came together
Japan's National Police Agency alerted Microsoft in late 2025 after fraud targeting people and businesses in Japan, according to Microsoft and TRM Labs. Partners included Japan's JC3 cybercrime center, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft says the US Secret Service was also involved.
TRM Labs says its intelligence helped locate and freeze assets linked to the group. No arrests have been announced.
"The scam message is often the only part victims see," wrote Steven Masada, who leads Microsoft's Digital Crimes Unit. CyberScoop quotes him on how hard such services are to stamp out: "Delete and block one, and another takes its place."
Microsoft lists healthcare, financial services, wholesale distribution and IT among the most targeted sectors. Japan, the US, Australia and India were the most targeted countries.
What this means for developers
For teams that run identity, email or sign-in for their organization:
- Use phishing-resistant sign-in. Microsoft recommends passkeys and phishing-resistant multifactor authentication, especially for admin accounts. Fake login pages cannot reuse a passkey.
- Review device code sign-in. Attackers abused it to steal tokens. If your users do not need it, consider blocking it in your access policies.
- Restrict where MFA is registered. Microsoft advises allowing new MFA methods and passkeys only from trusted locations and devices.
- Treat education and nonprofit domains with care. YAM Store sold accounts on real-looking .edu and .org tenants. A trusted-looking sender domain is not proof of a trusted sender.
- Expect replacements. Taking down kits slows attackers, but new ones appear. Defenses that do not depend on spotting each fake page last longer.
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Sources
- Disrupting the service economy behind transnational cybercrime operations - Microsoft
- Global takedown hits network behind 1 billion phishing messages - BleepingComputer
- Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages - The Hacker News
- Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem - CyberScoop
Top comments (0)