MICROSOFT Threat Intelligence and the Microsoft Digital Crimes Unit have exposed Yam Store, a Chinese-language phishing ecosystem that has powered more than a billion phishing emails and SMS messages to tens of thousands of organisations in the past nine months.
At the heart of the operation is Yam Store, tracked by Microsoft as Storm-3119, a marketplace offering multiple phishing kits and infrastructure that lets threat actors masquerade as legitimate organisations by using expired or previously used Microsoft and Google domains. The activity has been linked to three main phishing kits—CoGUI, Haozi (also known as Phoenix), and Iron Man System—whose operators are tracked as Storm-2990. Since January 2026, these actors have facilitated the sending of over one billion messages to more than 75,000 organisations worldwide.
Microsoft notes that the infrastructure broker and kit operators form distinct but closely connected groups within a broader Chinese-language phishing ecosystem. The Iron Man System, in particular, is characterised by more than 2,335 templates spanning 139 countries, with the United States accounting for the largest share of templates.
Lures imitate a range of trusted brands and public‑sector organisations, and the kits employ evasion techniques such as geofencing, fake CAPTCHA gates, IP allow-lists and blocks, anti‑detection configurations, and Telegram bot integration to push notifications when targets interact with a lure. Yam Store also supplied cloud environments—Microsoft and Google domains tied to legitimate organisations—to enable infrastructure reuse and stealthier campaigns.
In response, Microsoft has disabled more than 20,000 Yam Store tenants, helped block some 140,000 malicious domains, and strengthened detections to curb fraudulent accounts and phishing activity. The firm also recommends ongoing user education, verification of sender identity, and thorough investigation of access granted to compromised infrastructure.