Microsoft has helped dismantle a sprawling phishing-as-a-service operation responsible for flooding inboxes and phones with over one billion scam messages. The operation targeted more than 75,000 organizations across 150 countries, according to the company. The takedown, conducted with help from Japan's National Police Agency and private security firms, strikes at a Chinese-language cybercrime ecosystem that sold ready-made phishing tools to anyone willing to pay.
How the Scheme Worked
The investigation began in late 2025 after Microsoft spotted malicious messaging campaigns hitting people in Japan. Researchers traced the activity to a marketplace called YAM Store, which acted as a one-stop shop for scammers. YAM Store sold three phishing kits—CoGUI, Haozi, and Iron Man System—along with access to compromised or fraudulently obtained Microsoft and Google cloud environments.
These kits provided everything a low-skill attacker needed: phishing templates impersonating banks, logistics companies, and government agencies, plus the infrastructure to blast out high volumes of emails and SMS messages. The Iron Man platform alone offered over 2,300 templates, Microsoft reported.
Buyers could purchase stolen Microsoft and Google accounts on YAM Store and use the kits to launch credential-stealing campaigns. YAM Store also hijacked expired web domains from legitimate organizations, creating fake sites to harvest more accounts for resale.
Why This Matters
Microsoft disabled over 20,000 accounts linked to YAM Store and blocked more than 100,000 domains being used for impersonation and fraud. The health sector cybersecurity nonprofit Health-ISAC helped seize and redirect domains powering the three platforms.
The numbers are significant. Over one billion messages since January 2026 means this operation was generating phishing attempts at a prodigious rate. The kits targeted healthcare organizations, financial institutions, and businesses in Japan, the U.S., Australia, and India—prime targets for credential theft and fraud.
What sets this operation apart is its professional packaging. Phishing-as-a-service (PhaaS) allows anyone to run scams regardless of technical skill. The ecosystem included customer support, cryptocurrency payment processing, and bundled infrastructure—essentially turning cybercrime into a subscription service.
The takedown creates a temporary lull. But the underlying model remains profitable, and the code, developers, and demand don't disappear with a court order. Microsoft tracks the marketplace as Storm-3119 and the developers as Storm-2990, noting shared code and infrastructure across the three kits—meaning these actors will likely regroup or clone their tools under new names.
Who Should Care
| Sector | Risk Level | Primary Threat |
|---|---|---|
| Healthcare organizations | High | Credential theft, patient data exposure |
| Financial institutions | High | Account takeover, fraud transactions |
| Small and medium businesses | Medium-High | Brand impersonation, vendor spoofing |
| IT managed service providers | Medium | Supply chain pivots to their clients |
| Individual consumers | Medium | General phishing, credential harvesting |
Healthcare and financial sector organizations face the highest risk because their credentials unlock valuable data or directly access money. Small businesses are attractive because they often lack dedicated security teams to detect impersonation attempts.
What It Means for You
If you manage IT or security at an organization, assume some of your users have received messages from this operation. Even though Microsoft has disrupted the infrastructure, the phishing templates and techniques are now public knowledge. Other actors can study them.
Use this window to audit your email authentication (SPF, DKIM, DMARC), train users on recognizing impersonation attempts, and verify that your cloud tenants have multi-factor authentication enforced.
Bottom Line
Microsoft's court-authorized operation is a significant blow to a well-organized phishing-as-a-service ecosystem. The disruption will likely cause a short-term dip in certain phishing campaigns, but the tools and tradecraft will persist. Treat this as a temporary reprieve, not a resolution.
Key takeaways
- Phishing-as-a-service operations dramatically lower the barrier for scammers, increasing attack volume
- Microsoft disrupted three kits responsible for over one billion messages targeting 75,000+ organizations
- The operation sold compromised cloud accounts and fake domains alongside phishing templates
- Takedowns create temporary relief but don't eliminate the underlying threat
Frequently asked questions
What were the names of the phishing kits involved?
Microsoft identified three kits: CoGUI (also known as NX or FA), Haozi (aka Phoenix), and Iron Man System.
How many organizations were targeted?
Over 75,000 organizations worldwide received messages from these phishing operations since January 2026.
What is YAM Store?
YAM Store was an underground marketplace selling phishing kits, compromised cloud accounts, and fraudulently obtained domains to scammers.
Did the operation affect regular consumers?
Yes. Messages targeted consumers, healthcare organizations, financial institutions, and businesses in over 150 countries.
What happened to the infrastructure?
Microsoft disabled over 20,000 accounts and blocked more than 100,000 domains being used for fraud.