Microsoft and Partners Dismantle Vast Chinese-Language Phishing Kit Ecosystem
Microsoft, alongside international partners, has successfully dismantled a large Chinese-language phishing kit ecosystem operated by the threat group Storm-2990, which generated over 1 billion phishing messages targeting 75,000 organizations globally.
Microsoft, in collaboration with Japanese authorities, Health-ISAC, and several cybersecurity firms, has announced the disruption of a significant Chinese-language cybercrime ecosystem. This operation, attributed to a threat group tracked as Storm-2990, involved the sale and distribution of customized phishing kits and related services through platforms such as YAM Store, CoGUI, and Iron Man. Since the beginning of 2026, these tools have been instrumental in sending over one billion phishing emails and SMS messages, impacting more than 75,000 organizations worldwide, with a majority of these malicious communications targeting Microsoft customers.
The sophisticated phishing kits offered by Storm-2990 provided cybercriminals with templates designed to impersonate legitimate brands, facilitating high-volume campaigns. The investigation, initiated in early 2025 by Microsoft and Japanese authorities, uncovered an interconnected network of threat actors and services. The primary targets of these phishing campaigns were organizations in the healthcare, financial services, logistics, and IT sectors, with a predominant focus on victims in the United States and Japan.
Through a federal court order, Microsoft and Health-ISAC were able to seize and redirect domains that served as the core infrastructure for these cybercrime tools. Additionally, Microsoft has disabled over 20,000 accounts associated with the YAM Store platform and continues to dismantle the operation by removing associated infrastructure hosted on its services and blocking more than 100,000 domains used for fraudulent activities. This multi-faceted approach aims to cripple the operational capabilities of the threat group.
Steven Masada, general counsel and general manager of Microsoft’s Digital Crimes Unit, highlighted the pervasive nature of these scams, noting that while individual messages may seem like simple scams, they are often the visible tip of much larger, transnational criminal operations. The kits were designed to trick recipients into clicking malicious links, sharing personal information, or making fraudulent payments, leading to credential theft, financial fraud, and the abuse of authentication processes.
Analysis by researchers indicated that the tools likely shared development origins, code reuse, or close collaboration among developers due to similar infrastructure and overlapping activity. Cybercriminals utilized the stolen credentials and authentication tokens to gain unauthorized access to compromised accounts. The primary monetization strategy involved using stolen payment data for fraudulent purchases of high-end goods or for transactions on legitimate financial platforms.
Resecurity, an investigative partner, gained access to the Iron Man infrastructure and discovered 2,360 phishing templates impersonating a wide array of entities, including banks, retailers, healthcare providers, transportation authorities, police departments, and government agencies across 130 countries. Other contributing partners included Cloudflare, Oracle, Proofpoint, and TRM Labs, who provided crucial research and investigative support.
Masada further explained that the operation, which initially targeted individuals and organizations in Japan, ultimately revealed a global underground service economy supplying cybercriminals. While YAM Store, CoGUI, and Iron Man represent only a portion of this larger network, their disruption significantly hinders criminals' ability to acquire the necessary accounts, tools, and infrastructure for their operations. The coordinated effort underscores the importance of international cooperation in combating sophisticated cybercrime syndicates.
This new report from Microsoft details the disruption of the YAM Store, CoGUI, and Iron Man platforms, which were central to the Chinese-language phishing operation. The action, backed by a federal court order, specifically targeted domains used by these platforms to distribute over one billion phishing messages, adding further detail to the overall takedown of the Storm-2990 ecosystem.
This latest report from Microsoft details the specific phishing platforms dismantled: YAM Store, CoGUI, and Iron Man. It highlights that these platforms collectively enabled over 750 million messages targeting Microsoft customers alone since January, impersonating more than 75,000 organizations globally. The article also provides deeper insights into the functionalities of Iron Man as a phishing-kit-as-a-service and YAM Store as an initial access broker marketplace, detailing how cybercriminals purchased compromised accounts and expired domains.
This new article from Microsoft Security Blog provides further technical depth into the Chinese-language phishing kit ecosystem, detailing the YAM Store (Storm-3119) as a central marketplace and its role in selling compromised cloud infrastructure. It also elaborates on three specific phishing kits—CoGUI, Haozi, and Iron Man System (all tracked under Storm-2990)—and their capabilities, noting their shared infrastructure and functionality despite distinct branding. The report highlights the scale of operations, with over one billion phishing emails and SMS messages sent since January 2026, and details the five-stage attack pipeline used by YAM Store to acquire and monetize compromised environments.