Microsoft Disrupts Yam Store, the Marketplace Behind a Billion Phishing Messages

Microsoft has worked with industry and law enforcement partners, including Japanese police, to disrupt a large phishing network that has targeted tens of thousands of organisations worldwide since January. According to Microsoft's report, published on October 14, the network is made up of Chinese-language phishing-as-a-service operators, developers and a marketplace selling tools and infrastructure. Targets were in healthcare, financial services, wholesale distribution and IT across Japan, the US, Australia and India.

At the centre is Yam Store, an underground marketplace Microsoft tracks as Storm-3119. It sells compromised or fraudulently obtained Microsoft and Google domains, along with three phishing kits: CoGUI, Haozi and Iron Man System, grouped by Microsoft as Storm-2990. Microsoft says these kits have been behind more than a billion phishing emails and texts sent to over 75,000 organisations since January 2026. They are designed to impersonate organisations in order to steal sign-in details and credit card information.

Microsoft also described how the operators obtained their infrastructure. They found internet domains that legitimate organisations had let expire, then rebuilt the websites so those organisations appeared active. This let them fraudulently obtain Microsoft 365 accounts to sell through the store. In other cases, they created fake organisations, likely using AI-generated content and forged documents, to set up Microsoft tenants.