Microsoft Exposes Global Phishing Marketplace Selling Cloud Accounts, Kits, and Infrastructure to Criminals

Microsoft uncovered a global criminal marketplace supplying phishing kits, stolen cloud accounts, and hosting infrastructure used in large‑scale credential theft campaigns targeting organizations across Japan, the United States, Australia, and India.

Working with Resecurity, Microsoft identified three major phishing kits—CoGUI, Haozi, and Iron Man System—sold through YAM Store, an underground marketplace the company tracks as Storm‑3119. The developers behind these kits, grouped under Storm‑2990, helped facilitate more than one billion phishing emails and SMS messages since January 2026, targeting over 75,000 organizations worldwide.

The kits provide professionally designed templates impersonating banks, government agencies, retailers, delivery companies, and tech platforms. Templates are localized for more than 139 countries, using trusted brands and native languages to increase victim engagement. Operators receive real‑time Telegram alerts when victims submit passwords, payment details, or verification codes, allowing them to monitor each step and manually control what appears next.

YAM Store also sold access to compromised or fraudulently obtained Microsoft and Google cloud environments. Listings were categorized by age, subscription type, and organization type—including educational institutions and nonprofits. Criminal operators used stolen application credentials to reset passwords, assign licenses, and maintain persistent access. They converted compromised SharePoint and OneDrive storage into hosting services for buyers, creating what Microsoft described as “more durable, more scalable, and harder to detect” infrastructure.

The marketplace created fake organizations using AI‑generated content and forged documents to obtain new cloud accounts. Operators also acquired expired domains belonging to legitimate organizations, rebuilt their websites, and used those identities to fraudulently obtain Microsoft 365 accounts for resale. YAM Store supported resellers and relied on Telegram for storefront notifications and buyer communication.

Iron Man System alone contained more than 2,335 phishing templates tailored to 139+ countries. Kits included features such as country‑based access restrictions, IP blocking, and fake CAPTCHA challenges to hinder investigation. Buyers used stolen credentials to commit financial fraud and access victim accounts.

The investigation began in late 2025 after Japan’s National Police Agency alerted Microsoft to widespread phishing campaigns. Microsoft conducted test purchases to map the marketplace’s operations and identify the infrastructure supporting the scams.

Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health‑ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man System. Microsoft disabled more than 20,000 accounts linked to the marketplace and blocked over 100,000 domains used for impersonation and fraud.

“The businesses behind it are what make it possible,” Microsoft said, emphasizing that disrupting the suppliers is essential to reducing global phishing activity.