MICROSOFT’S latest threat intelligence review exposes a Chinese-language phishing kit ecosystem that enables mass credential theft and fraud at scale. The researchers identify three kits marketed via the underground YAM Store — CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System — collectively tracked as Storm-2990.
Since early 2026, operators behind these kits have facilitated the sending of more than a billion phishing messages to over 75,000 organisations across healthcare, financial services, wholesale distribution and IT in the United States, Japan, Australia and India. The research links these kits through shared infrastructure and overlapping development, suggesting common origins or close collaboration.
A notable element is YAM Store’s role as an initial access broker, reselling compromised Microsoft and Google environments and services to downstream actors.
Microsoft details a five-stage lifecycle for Storm-3119’s acquisition and monetisation of infrastructure: reconnaissance to identify target cloud tenants; environment takeover via app-only admin panels; storage and resource abuse using service principals to grant broad Graph permissions; dedicated phishing and DNS infrastructure to support credential harvesting; and a storefront to monetise stolen accounts, licenses and storage.
The Iron Man System kit adds live, interactive phishing via WebSocket and Telegram, with more than 2,335 templates spanning 139 countries and a strong emphasis on government, transportation, and tax-related lures. Downstream activity includes credential and device-code phishing and financial fraud. Microsoft’s guidance emphasises user education, MFA with passkeys, least-privilege and Zero Trust, and Defender configurations to blunt such phishing ecosystems.
The company notes that the implicated activity, while linked to specific Storm-3119/Storm-2990 infrastructure, represents a broader class of social engineering attacks that could affect any organisation.