Inside the Chinese-Language Phishing Marketplace Behind Over a Billion Scam Messages

Microsoft has detailed a Chinese-language cybercriminal ecosystem that supplies phishing tools and infrastructure to attackers around the world. The network links phishing kit developers, an infrastructure dealer and the threat actors who buy from both. Customers bought phishing kits and access to compromised or fraudulent Microsoft or Google cloud environments, along with related credentials, to run large-scale campaigns.

Microsoft's research began with a single phishing kit and grew into a view of the wider ecosystem. Three kits were sold through YAM Store, an underground marketplace Microsoft tracks as Storm-3119: CoGUI (also known as NX or FA), Haozi (also known as Phoenix) and Iron Man System. Microsoft, working with industry partner Resecurity, tracks the developers behind all three kits as Storm-2990. Since January 2026, the actors behind these kits have facilitated the sending of over one billion phishing emails and SMS messages to more than 75 thousand organisations worldwide.

Targets included organisations in healthcare, financial services, wholesale distribution and information technology, across Japan, the United States, Australia and India. Microsoft's Digital Crimes Unit, together with law enforcement agencies and other partners worldwide, facilitated a disruption of the ecosystem's primary developers and infrastructure. Microsoft's blog goes on to examine the technical aspects of the kits, the shared infrastructure, how it was provisioned, and the downstream activity of the actors using these tools.