Global takedown hits network behind 1 billion phishing messages

YAM Store, also tracked as Storm-3119, was an underground infrastructure marketplace. It sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage. The CoGUI, Haozi, and Iron Man System kits, collectively tracked as Storm-2990, provided the tools for phishing campaigns.

The marketplace and kits complemented each other. YAM supplied cloud environments, domains, and storage, while the kits supplied ready-made lures and fake pages. Those pages impersonated banks, retailers, delivery companies, government agencies, and other trusted organizations. They also used geofencing, fake CAPTCHA tests, and IP filtering to avoid detection.

Together, the services created a scalable criminal operation. Operators could acquire convincing identities, host phishing content, and send fraudulent messages through a shared ecosystem. Microsoft linked the activity to more than 750 million messages targeting Microsoft 365 customers, including campaigns that used device-code phishing to obtain authentication tokens.

The operation was unusually broad. The article describes more than a billion malicious messages targeting over 75,000 organizations across 150 countries. Since the start of the year, more than 750 million messages specifically targeted Microsoft customers through email and SMS.

Its infrastructure was also extensive. Proofpoint found more than 17,000 domains used by CoGUI, CoAceV, and CoFish_Ws. Resecurity identified a publicly exposed registry containing 911 published builds and eight registered accounts. Another subsystem cataloged 2,360 phishing packages covering 130 countries or areas.

The disruption figures show the response’s scale. Microsoft deactivated more than 20,000 accounts associated with YAM Store and blocked 100,000 domains used for impersonation and fraud. These figures represent different parts of the ecosystem, so they should not be added together as one victim or infrastructure count.

The campaigns copied organizations people commonly trust when handling money, deliveries, travel, or official requests. Iron Man offered more than 2,300 templates impersonating banks, retailers, delivery services, and government agencies. CoGUI campaigns also impersonated well-known Japanese companies and international organizations.

The messages used familiar problems to create urgency. Examples included unpaid tolls, traffic penalties, delivery failures, and account verification requests. A recipient might be pushed toward a fake payment page, login screen, or verification process. These scenarios were designed to make a harmful request look routine.

The kits added technical features that made the deception harder to study. They supported geofencing, fake CAPTCHA gates, and IP filtering. Geofencing could show different content based on location, while filtering could block researchers or security tools. The article also describes campaigns focused on stealing credentials and payment data.

The article identifies device-code phishing as a method used against Microsoft 365 customers, but it does not explain the mechanics. In the standard device-authorization flow, a service displays a short code and asks a user to enter it on a legitimate sign-in page.

An attacker can send a convincing message containing a code or a link and persuade the victim to complete that step. The victim may then authenticate at the real service, believing the request is genuine. The service returns authorization to the device or session associated with the attacker’s request.

That process can give the attacker an authentication token without requiring the attacker to collect the password directly. The token can act as proof of an approved session, depending on the service and protections in place. Microsoft said many of the campaigns used this technique to obtain authentication tokens from targeted Microsoft 365 customers.

Expired domains could provide the appearance of real organizations without requiring criminals to build credibility from nothing. Operators rebuilt websites so defunct entities appeared active, then used those identities to obtain cloud accounts. They also created fake organizations with content and documentation, using AI tools as part of the process.

After gaining access to Microsoft environments, operators used stolen application credentials to manage accounts and licenses. They abused SharePoint and OneDrive storage for hosting. These services formed part of the infrastructure supporting phishing pages and related campaign materials.

The approach combined social credibility with legitimate cloud resources. A familiar-looking domain or business identity could make a message seem more trustworthy. Cloud accounts and storage provided operational capacity for the campaigns. The article does not state that every victim saw content hosted on every service, but it links these resources to the wider YAM Store infrastructure.

The disruption followed an investigation initiated by Microsoft and Japan’s National Police Agency into fraudulent activity. Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man.

Microsoft also deactivated more than 20,000 accounts associated with YAM Store. It blocked 100,000 domains that criminals used for impersonation and fraud. Redirecting or seizing domains removed control from the operators and interrupted websites connected with the phishing infrastructure.

The effort extended beyond Microsoft and the NPA. Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs also participated in the investigation or infrastructure removal. The article says more infrastructure was still being removed based on the findings, so the disruption was continuing rather than limited to one takedown.

Phishing operations depend on infrastructure to present fake websites, store campaign materials, manage accounts, and support message delivery. When that infrastructure is seized, redirected, blocked, or deactivated, criminals lose access to important parts of the operation. Their existing campaigns can be interrupted, and victims may be unable to reach the original fraudulent pages.

In this case, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man. Microsoft also deactivated more than 20,000 related accounts and blocked 100,000 domains used for impersonation and fraud. Those actions targeted both the operators’ identities and their delivery channels.

The disruption does not automatically erase every malicious message already sent or eliminate every related system. The article says additional infrastructure was still being removed, showing that the operation had multiple components. Removing more components can reduce the campaign’s reach and force criminals to rebuild, but the article does not quantify the remaining victim exposure.