Microsoft disrupts phishing network behind 1 billion messages

Microsoft and a group of partners have disrupted a cybercrime marketplace and three phishing kits linked to more than 1 billion scam emails and text messages this year. The operation was announced on October 14, 2026 and carried out under an order from a US federal court in Florida. Microsoft disabled more than 20,000 accounts and blocked more than 100,000 domains. The kits were rented out as a service, which let people with little skill run large phishing campaigns.

What was taken down

According to Microsoft's announcement, the targets were a marketplace called YAM Store and three phishing kits: CoGUI, Haozi and Iron Man. A phishing kit is ready-made software for building fake login pages and sending the lures that point to them.

Microsoft tracks YAM Store as Storm-3119 and the kit developers as Storm-2990. It says with high confidence that Chinese-speaking actors built the kits.

YAM Store sold access to Microsoft 365 and Azure for Education tenants, Microsoft and Google environments, licenses, storage and credentials. Some operators bought expired nonprofit and education domains to obtain Microsoft 365 accounts for resale, TRM Labs reports.

The scale

Measure	Figure
Phishing emails and texts sent since January 2026	More than 1 billion
Messages aimed at Microsoft customers	More than 750 million
Organizations targeted	More than 75,000
Countries	More than 150
Accounts Microsoft disabled	More than 20,000
Domains Microsoft blocked	More than 100,000

The Hacker News reports that the three kits used about 17,000 unique domains.

How the kits worked

The Iron Man kit offered more than 2,335 templates covering more than 139 countries, Microsoft says. It impersonated government agencies, including traffic and parking authorities, as well as banks, healthcare providers, retailers and streaming services.

The kits used several tricks to avoid detection:

• Fake CAPTCHA pages that block automated security scanners.
• Location filters and IP lists that show the scam only to intended targets.
• Telegram alerts that notify the operator when a victim enters details.
• Live sessions that let operators interact with a victim in real time.

They harvested login details and payment card data. In some cases, attackers abused device code sign-in to steal access tokens. That is a login flow where a user types a short code on a second device.

How the case came together

Japan's National Police Agency alerted Microsoft in late 2025 after fraud targeting people and businesses in Japan, according to Microsoft and TRM Labs. Partners included Japan's JC3 cybercrime center, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft says the US Secret Service was also involved.

TRM Labs says its intelligence helped locate and freeze assets linked to the group. No arrests have been announced.

"The scam message is often the only part victims see," wrote Steven Masada, who leads Microsoft's Digital Crimes Unit. CyberScoop quotes him on how hard such services are to stamp out: "Delete and block one, and another takes its place."

Microsoft lists healthcare, financial services, wholesale distribution and IT among the most targeted sectors. Japan, the US, Australia and India were the most targeted countries.

What this means for developers

For teams that run identity, email or sign-in for their organization:

• Use phishing-resistant sign-in. Microsoft recommends passkeys and phishing-resistant multifactor authentication, especially for admin accounts. Fake login pages cannot reuse a passkey.
• Review device code sign-in. Attackers abused it to steal tokens. If your users do not need it, consider blocking it in your access policies.
• Restrict where MFA is registered. Microsoft advises allowing new MFA methods and passkeys only from trusted locations and devices.
• Treat education and nonprofit domains with care. YAM Store sold accounts on real-looking .edu and .org tenants. A trusted-looking sender domain is not proof of a trusted sender.
• Expect replacements. Taking down kits slows attackers, but new ones appear. Defenses that do not depend on spotting each fake page last longer.