Phishing as a service: the kit market behind a billion lures
Microsoft has mapped a Chinese-language marketplace that sells hijacked cloud accounts to three phishing-kit operators. Since January their kits have helped send more than a billion phishing emails and texts to over 75,000 organisations.
Phishing has a supply chain, and Microsoft's threat intelligence and Digital Crimes Unit teams have now drawn it. At the top sits an underground marketplace they call YAM Store (tracked as Storm-3119), which sells access to compromised or fraudulently created Microsoft and Google cloud environments. Below it are three phishing kits sold through the same store, CoGUI, Haozi and Iron Man System (together Storm-2990), which turn that infrastructure into lures aimed at the public and at companies. Microsoft, working with Resecurity and law enforcement, says it has disrupted the ecosystem's main developers and infrastructure.
What they found
- Since January 2026 the three kits have been used to send more than one billion phishing emails and text messages to over 75,000 organisations, with healthcare, financial services, wholesale distribution and IT firms in Japan, the United States, Australia and India hit hardest.
- YAM Store hijacks Microsoft 365 and Azure for Education tenants through stolen application credentials, resets passwords silently, grants itself licences and storage, then resells the accounts and SharePoint space. It also fabricates "organisations", in one case a fake non-profit with an AI-generated website, to open fresh tenants.
- The Iron Man System kit ships more than 2,335 templates for over 139 countries, impersonating toll and parking authorities, postal services, banks and retailers. The kits geofence their pages, use fake CAPTCHA gates to keep researchers out, and send the operator a Telegram alert the moment a victim types a password or card number, so the attacker can steer the victim live.
- Customers of the kits go on to steal credentials, abuse the device-code sign-in flow to capture tokens, and run card fraud.
What to do
- Treat urgency as the red flag it is: a "missed toll" or "account check" message should be verified with the organisation directly, never through the link.
- Watch for application-level persistence in your own tenant: unexpected service principals, broad Graph permissions and silent password resets are the fingerprints of this kind of takeover.
- Keep training staff on the lures, which now copy local brands in local languages.
Source: The hidden network: inside the phishing infrastructure ecosystem powering global cybercrime, Microsoft Security Blog, 14 October 2026. Summary by the Cyber Risk Barometer.