Cyber Security· Important

Microsoft exposes Chinese-language phishing-as-a-service network behind over a billion phishing messages

In short: Microsoft, with partner Resecurity, uncovered a Chinese-language cybercriminal ecosystem built around an underground marketplace called YAM Store (Storm-3119) that sells access to compromised or fraudulently obtained Microsoft and Google cloud tenants. This infrastructure feeds three related phishing-kit operations (CoGUI, Haozi, Iron Man System), tracked together as Storm-2990, which since January 2026 have sent over one billion phishing emails and SMS messages targeting more than 75,000 organizations in healthcare, finance, distribution and IT across Japan, the US, Australia and India. Microsoft's Digital Crimes Unit worked with law enforcement to disrupt the developers and core infrastructure.

Source: Microsoft Security14 Oct 2026, 16:00Microsoft Original article ↗

This summary was generated automatically by AI from Microsoft Security's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.

What changed?

1YAM Store (Storm-3119) brokers access to hijacked or fraudulently created Microsoft 365/Azure for Education tenants, reselling accounts, licenses and storage
2Five-stage pipeline: automated reconnaissance via Flask/Tor, app-only admin panel takeover of tenants, abuse of SharePoint/OneDrive via PnP Management Shell service principal, dedicated phishing DNS infrastructure via Cloudflare, and an automated storefront accepting crypto/Alipay/WeChat payments
3Storm-2990 phishing kits (CoGUI, Haozi, Iron Man System) sold as phishing-as-a-service with over 2,335 templates targeting 139+ countries, impersonating government, logistics, financial and healthcare brands
4Kits support geofencing, fake CAPTCHA, IP allow/block lists, anti-detection settings and live Telegram-bot notifications with WebSocket-based real-time credential harvesting
5Microsoft DCU and law enforcement partners disrupted the primary developers and infrastructure behind the ecosystem

Why it matters

This shows how a single criminal marketplace can industrialize phishing by selling ready-made, hard-to-detect infrastructure (stolen cloud tenants, licenses, storage, DNS) to multiple phishing-kit operators, lowering the skill bar for mass credential and payment-card theft at global scale.

What it means for AI agents and contact centers

If your company relies on Microsoft 365 or Azure tenants, or on CRM/email systems tied to them, this is a reminder that attackers actively hunt for expired or loosely managed organization accounts to hijack via application-level credentials — worth reviewing tenant hygiene, app consent/service principal permissions, and monitoring for unusual SharePoint/OneDrive or Graph API activity, since phishing lures impersonating financial, logistics and government brands could also target contact-center agents or customers.

Phishing Cybercrime Microsoft 365 Azure PaaS Threat Intelligence Social Engineering

Sources

Microsoft SecurityOfficialPrimary source
„The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime“
14 Oct 2026, 16:00
Original article →

Published by source: 14 Oct 2026, 16:00
Found by our system: 14 Oct 2026, 17:11
Summary generated: 14 Oct 2026, 17:12

This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy