As cited
Copy frozen at (site build).
threat intel
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language phishing kit ecosystem comprising three interconnected phishing-as-a-service platforms (CoGUI, Haozi, and Iron Man System) sold through an underground marketplace called YAM Store, tracked as Storm-3119 and Storm-2990. Since January 2026, these operations have sent over one billion phishing emails and SMS messages to 75,000 organizations globally, targeting healthcare, financial services, wholesale distribution, and information technology sectors across Japan, the United States, Australia, and India. YAM Store functions as an initial access broker selling fraudulently obtained Microsoft 365 and Google Cloud environments, which the phishing kits then abuse to conduct large-scale credential theft and financial fraud campaigns.
Why it matters: Organizations in healthcare, finance, distribution, and IT in Japan, the US, Australia, and India face active phishing campaigns using customized templates and advanced evasion techniques; practitioners should enforce multifactor authentication (MFA), implement passwordless authentication, enable Microsoft Defender for Office 365 protections, and train users on phishing red flags given the scale and sophistication of this ecosystem.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language phishing kit ecosystem comprising three interconnected phishing-as-a-service platforms (CoGUI, Haozi, and Iron Man System) sold through an underground marketplace called YAM Store, tracked as Storm-3119 and Storm-2990. Since January 2026, these operations have sent over one billion phishing emails and SMS messages to 75,000 organizations globally, targeting healthcare, financial services, wholesale distribution, and information technology sectors across Japan, the United States, Australia, and India. YAM Store functions as an initial access broker selling fraudulently obtained Microsoft 365 and Google Cloud environments, which the phishing kits then abuse to conduct large-scale credential theft and financial fraud campaigns.
Why it matters: Organizations in healthcare, finance, distribution, and IT in Japan, the US, Australia, and India face active phishing campaigns using customized templates and advanced evasion techniques; practitioners should enforce multifactor authentication (MFA), implement passwordless authentication, enable Microsoft Defender for Office 365 protections, and train users on phishing red flags given the scale and sophistication of this ecosystem.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language phishing kit ecosystem comprising three interconnected phishing-as-a-service platforms (CoGUI, Haozi, and Iron Man System) sold through an underground marketplace called YAM Store, tracked as Storm-3119 and Storm-2990. Since January 2026, these operations have sent over one billion phishing emails and SMS messages to 75,000 organizations globally, targeting healthcare, financial services, wholesale distribution, and information technology sectors across Japan, the United States, Australia, and India. YAM Store functions as an initial access broker selling fraudulently obtained Microsoft 365 and Google Cloud environments, which the phishing kits then abuse to conduct large-scale credential theft and financial fraud campaigns.
Why it matters: Organizations in healthcare, finance, distribution, and IT in Japan, the US, Australia, and India face active phishing campaigns using customized templates and advanced evasion techniques; practitioners should enforce multifactor authentication (MFA), implement passwordless authentication, enable Microsoft Defender for Office 365 protections, and train users on phishing red flags given the scale and sophistication of this ecosystem.
- Source published
- First seen by Cybersecurity Tracker