An international law enforcement effort has disrupted a major cybercriminal network responsible for distributing more than a billion malicious messages targeting roughly 75,000 organizations worldwide. The operation, which has sent over 750 million phishing messages to Microsoft customers via email and SMS since January, relied on a Chinese-language underground marketplace to coordinate its activities across 150 countries.
The investigation began when Microsoft and Japan's National Police Agency (NPA) examined a series of fraudulent campaigns and uncovered what they describe as "a sprawling Chinese-language cybercrime marketplace." Researchers traced the malicious infrastructure to YAM Store (Storm-3119), an underground platform selling phishing tools and services, which was then connected to three phishing kits: CoGUI, Haozi, and Iron Man System, collectively designated as Storm-2990.
Infrastructure and capabilities
YAM Store functioned as a marketplace for compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage resources. The operators employed multiple tactics to establish their phishing infrastructure, including acquiring expired domains belonging to legitimate organizations, reconstructing their websites to present the defunct entities as active, and leveraging those identities to register cloud accounts.
In another approach, the operators created entirely fabricated organizations complete with supporting content and documentation, utilizing AI tools to generate convincing materials. Once they gained access to Microsoft environments, they exploited stolen application credentials to manage accounts and licenses, while abusing SharePoint and OneDrive storage as hosting platforms for their phishing content.
The phishing kits distributed through this ecosystem offered attackers diverse pretexts for their campaigns, ranging from unpaid tolls and traffic penalties to delivery failures and account verification prompts. To evade detection by security researchers and automated defenses, the kits incorporated geofencing capabilities, counterfeit CAPTCHA interfaces, IP filtering, and additional obfuscation techniques.
CoGUI initially concentrated on victims in the United States and Japan, but Iron Man gradually displaced it as the dominant tool by mid-2026. Iron Man provided attackers with access to more than 2,300 templates designed to impersonate banks, retailers, delivery companies, and government institutions.
Cybersecurity firm Resecurity contributed to the investigation by analyzing exposed infrastructure components, discovering a publicly accessible Git and container registry containing 911 published builds and eight registered user accounts. The researchers cataloged a product-selection subsystem connected to payment-card theft, which maintained a database of 2,360 phishing packages targeting 130 countries and regions, with updates continuing through October 1, 2026.
The phishing platforms delivered their 750 million messages primarily through device-code phishing attacks designed to steal authentication tokens from Microsoft 365 users. In late 2024, security company Proofpoint had already identified email campaigns consistently directed at Japan that utilized the CoGUI phishing kit, with attackers impersonating recognized Japanese firms and international bodies to harvest credentials and payment information.
Subsequent analysis revealed that the three phishing kits—CoGUI, CoAceV, and CoFish_Ws—operated across more than 17,000 domains. Researchers characterized the operation as "dynamic" and possessed sufficient resources "to purchase and manage phishing infrastructure at scale."
Takedown operations
Acting under a court order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC moved to seize and redirect domains supporting YAM Store, CoGUI, and Iron Man. Microsoft simultaneously deactivated more than 20,000 accounts connected to YAM Store and blocked 100,000 domains that the cybercriminals had registered for impersonation and fraud purposes.
The ongoing dismantling of the operation involves continued infrastructure removal based on investigation findings. The effort includes participation from Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.