Summary

Microsoft says its Digital Crimes Unit helped disrupt the primary developers and infrastructure of a phishing ecosystem. The company says operators using its tools facilitated more than 1 billion phishing emails and SMS messages to over 75,000 organizations since January 2026.

Microsoft says its Digital Crimes Unit (DCU), working with law enforcement agencies and other partners worldwide, helped disrupt the primary developers and infrastructure of an interconnected phishing ecosystem. Microsoft Threat Intelligence says operators using three phishing kits in the network facilitated the sending of more than 1 billion phishing emails and SMS messages to over 75,000 organizations worldwide since January 2026.

The activity targeted organizations in sectors including healthcare, financial services, wholesale distribution and information technology in Japan, the United States, Australia and India. Microsoft’s account describes a supply chain that paired phishing software with cloud infrastructure resold to criminals.

Contents

A marketplace supplied infrastructure and kits

Microsoft and industry partner Resecurity identified three phishing kits sold through an underground marketplace called YAM Store: CoGUI, also known as NX or FA; Haozi, also known as Phoenix; and Iron Man System. Microsoft tracks the marketplace as Storm-3119 and the kit developers and related activity as Storm-2990. Microsoft assesses with high confidence that the kits were developed by Chinese-speaking threat actors.

YAM Store acted as an initial access broker: it sold access to compromised or fraudulently obtained Microsoft and Google cloud environments, including accounts, licenses and storage. Microsoft says the marketplace used automation to find opportunities to take over cloud environments and resold resources to phishing-kit operators and other customers. The kits and infrastructure were therefore parts of a wider service network, rather than a single phishing tool.

How the kits supported phishing

The kits supplied templates impersonating organisations and brands, including government, financial, healthcare, transport and retail services. Iron Man System contained more than 2,335 templates tailored to over 139 countries, including India, Japan, Australia and the United States.

The software included features that could restrict access by country, block or allow selected IP addresses, and use fake CAPTCHA screens to hinder automated inspection. It could also send operators Telegram notifications as a target entered credentials, payment-card details or verification codes. Microsoft says the kit collected submitted information through a WebSocket, allowing operators to monitor victims’ progress and interact with phishing sessions in real time.

In downstream campaigns, Microsoft observed credential theft, attempts to obtain authentication tokens through device-code phishing, and financial fraud using stolen payment details. A device-code attack tricks a person into authenticating to a legitimate application, which can give an attacker an access token without collecting the person’s password directly.

Why the ecosystem matters

The operation illustrates how criminal marketplaces can combine stolen cloud access, phishing templates and management tools into services that other actors can buy and use. That arrangement can lower the technical effort needed to run phishing campaigns at scale. Microsoft says the ecosystem’s services extended beyond Microsoft products, even though its investigation documented abuse involving Microsoft and Google environments.

Microsoft characterizes the action as a disruption of the ecosystem’s primary developers and infrastructure. The company’s post does not quantify how much of the marketplace or downstream activity was disabled.

Sources