Microsoft and Japan’s National Police Agency announced a takedown of Yam Store on October 14, a Chinese-language cybercrime marketplace tracked as Storm-3119. Yam Store never sent a phishing message. It sold the infrastructure: hijacked Microsoft and Google accounts, licenses, and storage, found by automated scanning for expired organization names and resold wearing the legitimate customer details attached to them.
Its customers did the sending. Microsoft groups the developers of three kits — CoGUI, Haozi, and Iron Man System — as Storm-2990, and says the actors behind them have pushed over one billion phishing emails and SMS messages at more than 75 000 organizations across 150 countries since January 2026. Iron Man System alone carries 2 335 templates aimed at 139 countries, and only reached Yam Store in June.
Acting on a US court order and working with Resecurity, Cloudflare, Oracle, Proofpoint, and others, Microsoft has disabled over 20 000 tenants and 140 000 malicious domains.
Resetting passwords won’t finish the job. Andrew Costis of AttackIQ points out that an application has its own identity and permissions, so access granted to one during an attack survives a password change. Corsica Technologies CISO Ross Filipek adds that device code phishing lands victims on genuine sign-in pages, which is why training people to check where a link goes doesn’t catch it.
Source: Dark Reading
