Global takedown hits network behind 1 billion phishing messages

Law enforcement agencies, in collaboration with Microsoft and other partners, dismantled a large-scale cybercriminal ecosystem known as YAM Store (Storm-3119) that facilitated over one billion phishing messages globally. This marketplace sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage. Operators used expired domains and AI-generated fake organizations to obtain cloud accounts. Phishing kits CoGUI, Haozi, and Iron Man (Storm-2990) provided thousands of phishing templates impersonating banks, retailers, delivery services, and government agencies, targeting victims worldwide. The Iron Man kit alone offered over 2,300 templates covering 130 countries. The phishing campaigns delivered over 750 million messages targeting Microsoft 365 customers, often using device-code phishing to steal authentication tokens. Microsoft and partners seized domains, deactivated over 20,000 accounts, and blocked 100,000 domains used for impersonation and fraud. The takedown involved multiple international partners and continues to remove malicious infrastructure.

The phishing campaigns facilitated by this cybercriminal ecosystem targeted over 75,000 organizations in 150 countries, delivering more than one billion malicious messages. Over 750 million messages targeted Microsoft 365 customers, with attackers stealing authentication tokens via device-code phishing. The operation enabled widespread fraud, account compromise, and abuse of cloud services, potentially leading to data breaches, financial loss, and disruption of services for victims worldwide. The takedown disrupted the infrastructure, reducing ongoing phishing threats from these specific kits and marketplaces.

Microsoft and law enforcement have taken extensive action by seizing domains, deactivating over 20,000 accounts, and blocking 100,000 domains associated with the phishing ecosystem. Organizations should ensure they apply Microsoft’s latest security updates and monitor for any residual phishing activity. Since the infrastructure has been disrupted, immediate threat from these specific phishing kits is mitigated. Continued vigilance against phishing attempts and use of multi-factor authentication remain important, but no additional specific remediation is indicated by the vendor advisory.