MICROSOFT and law enforcement partners say they have dismantled a large-scale phishing ecosystem built around Yam Store, an underground marketplace tracked by Microsoft as Storm-3119. The operation unraveled after Microsoft and Japanese police investigated a network of Chinese-language PhaaS kit operators, developers and a marketplace selling tools and infrastructure.
The effort targets organisations across healthcare, financial services, wholesale distribution and IT, with activity observed in Japan, the United States, Australia and India. The core claim is that phishing kits and access to compromised Microsoft or Google cloud environments were used to target thousands of organisations worldwide since January 2026.
The phishing kits themselves are said to have produced more than one billion phishing emails and texts, reaching over 75,000 organisations since January 2026. Yam Store allegedly sells both compromised Microsoft and Google domains and three phishing kits—CoGUI (aka NX or FA), Haozi (aka Phoenix) and Iron Man System—bundled with access to hijacked accounts, licenses and cloud storage. Storm-3119 functions as the access broker, reselling these resources through an automated storefront. In some cases, the operators created fake organisations, possibly using AI-generated content and forged documents to establish Microsoft tenants.
Microsoft notes the presence of sophisticated evasion techniques, including geofencing, fake CAPTCHA gates and anti-detection configurations. It reports concrete takedown results: more than 20,000 accounts disabled and more than 100,000 domains used for impersonation and fraud blocked or removed. The article does not specify how many consumers versus organisations were targeted by Storm-2990 and Storm-3119, and the full extent of impact remains to be assessed.