Home / NewsOctober 16, 2026 · Source: Microsoft Security BlogMicrosoft said on October 14 that its Digital Crimes Unit, working with law enforcement and industry partners, had disrupted the developers and infrastructure of a Chinese-language cybercrime ecosystem built around phishing-as-a-service. The targets were YAM Store, an underground marketplace tracked by Microsoft as Storm-3119, and three phishing kits tracked together as Storm-2990: CoGUI, Haozi and Iron Man System. Security firm Resecurity is named as an industry partner.
According to Microsoft, the kits’ operators have facilitated more than one billion phishing emails and text messages since January 2026, reaching over 75,000 organizations worldwide in sectors including health care, financial services, wholesale distribution and IT. Japan and the United States were the most heavily affected countries, with activity also seen in Australia and India. The Iron Man kit alone offers more than 2,300 lure templates covering over 139 countries, impersonating governments, banks, logistics companies and well-known brands.
Microsoft describes a division of labor typical of modern cybercrime. YAM Store acts as an access broker, taking over Microsoft 365 and Google tenants, often at educational or nonprofit organizations, and reselling accounts, storage, DNS and phishing support. The kit developers sell subscriptions with evasion features such as geofencing, CAPTCHA gates and IP filtering, plus live victim control and Telegram alerts when someone submits credentials or card details. Buyers then use them for credential theft, device-code phishing and payment fraud, with payments taken in cryptocurrency as well as Alipay and WeChat Pay.
CyberScoop and Help Net Security also reported on the action. CyberScoop said partners included Japanese authorities and Health-ISAC and that more than 20,000 accounts were disabled; Microsoft’s own post does not detail the specific domain seizures or court orders, so those points should be treated as reported by the outlet rather than confirmed by the company.
Read the original report →
Click Here For The Original Source.
——————————————————–
