Cyber Security· Important
Microsoft exposes Chinese-language phishing-as-a-service network behind over a billion phishing messages
Microsoft, with partner Resecurity, uncovered a Chinese-language cybercriminal ecosystem built around an underground marketplace called YAM Store (Storm-3119) that sells access to compromised or fraudulently obtained Microsoft and Google cloud tenants. This infrastructure feeds three related phishing-kit operations (CoGUI, Haozi, Iron Man System), tracked together as Storm-2990, which since January 2026 have sent over one billion phishing emails and SMS messages targeting more than 75,000 organizations in healthcare, finance, distribution and IT across Japan, the US, Australia and India. Microsoft's Digital Crimes Unit worked with law enforcement to disrupt the developers and core infrastructure.