Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft and Health-ISAC seized domains linked to YAM Store, CoGUI, and Iron Man, components of a Chinese-language cybercrime marketplace that provided stolen Microsoft 365 and Azure for Education accounts, phishing kits, and infrastructure to criminals. The marketplace, tracked as Storm-3119, sold access to compromised or fraudulently obtained environments, enabling downstream phishing operations using kits like Storm-2990 (CoGUI, Haozi, Iron Man). These kits featured thousands of phishing templates targeting over 139 countries, with significant targeting of US entities impersonating government and transportation organizations. The phishing platforms allowed real-time monitoring and harvesting of credentials, including one-time verification codes. The operation was disrupted through a US District Court order, with Microsoft disabling accounts and blocking domains, supported by international law enforcement and cybersecurity firms. The phishing kits required regular contact with vendor licensing servers, a dependency exploited to degrade their operation.

The phishing marketplace facilitated the sending of over one billion malicious messages globally, targeting consumers and more than 75,000 organizations in over 150 countries, including over 750 million messages aimed at Microsoft customers. The operators generated tens of millions of dollars from selling stolen accounts and phishing infrastructure. The phishing kits enabled real-time credential harvesting and impersonation of trusted entities, increasing the risk of credential theft and fraud. The disruption of this infrastructure significantly impedes criminals' ability to obtain accounts and deploy phishing campaigns using these tools.

Microsoft and Health-ISAC have taken effective action by seizing domains, disabling over 20,000 accounts, and blocking more than 100,000 domains used for impersonation and fraud. The phishing kits depend on vendor licensing servers, so disabling or sinkholing these servers degrades all active deployments. Organizations should ensure they apply any relevant Microsoft security updates and monitor for phishing attempts leveraging similar infrastructure. No further immediate action is required from end users beyond standard phishing awareness and protection measures.