The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft's investigation revealed an interconnected phishing infrastructure ecosystem powered by Chinese-speaking threat actors. The ecosystem includes three phishing kits—CoGUI, Haozi, and Iron Man System—marketed through the underground YAM Store marketplace (tracked as Storm-3119). YAM Store acts as an initial access broker selling compromised or fraudulently obtained Microsoft 365 and Google cloud environments, which are then used by phishing kit operators (Storm-2990) to conduct high-volume phishing and credential theft campaigns. Since January 2026, these actors have sent over one billion phishing emails and SMS messages to more than 75,000 organizations globally. The ecosystem leverages automation and cryptocurrency payments to conceal illicit activity. Microsoft’s Digital Crimes Unit, in collaboration with law enforcement, disrupted the developers and infrastructure supporting this network.

The ecosystem enabled large-scale phishing campaigns targeting multiple sectors including healthcare, financial services, wholesale distribution, and IT. Over one billion phishing messages were sent, potentially leading to widespread credential theft and fraud losses. The use of compromised legitimate cloud environments increases the difficulty of detection and mitigation. The availability of this criminal infrastructure lowers the barrier to entry for less skilled cybercriminals, amplifying the scale and impact of phishing attacks worldwide.

Microsoft’s Digital Crimes Unit has disrupted the primary developers and infrastructure of this phishing ecosystem. Organizations should leverage Microsoft Defender detections and other security tools to identify and block activity related to these phishing kits and compromised cloud environments. Since this is a criminal infrastructure ecosystem rather than a software vulnerability, no patch applies. Continued collaboration with law enforcement and threat intelligence sharing is recommended to monitor and mitigate downstream activity.