A global phishing takedown has disrupted a cybercrime network linked to more than one billion malicious messages. The operation targeted over 75,000 organizations across 150 countries through infrastructure that supported large-scale fraud.
Since the beginning of 2026, the network has directed more than 750 million malicious email and SMS messages at Microsoft customers. Investigators connected the activity to an underground marketplace and several phishing platforms.
Investigation Uncovers Marketplace Supplying Phishing Operations
Microsoft and Japan’s National Police Agency began investigating after identifying a wave of fraudulent activity. Their work exposed a Chinese-language marketplace offering infrastructure and tools for phishing campaigns.
At the center stood YAM Store, which investigators track as Storm-3119. The marketplace supplied compromised or fraudulently acquired Microsoft and Google environments, alongside accounts, licenses and storage.
Investigators then connected its services to the CoGUI, Haozi and Iron Man System phishing kits. These platforms fall under the collective tracking name Storm-2990.
Together, the marketplace and phishing tools gave criminals the resources to launch campaigns across numerous countries.
Expired Domains and Fake Organizations Helped Obtain Accounts
YAM Store’s operators used several methods to acquire cloud infrastructure.
For example, they purchased expired domains belonging to genuine organizations. They then rebuilt websites to make those inactive organizations appear operational again.
Using these revived identities, the operators obtained cloud accounts. Alternatively, they used AI tools to create fictitious organizations with supporting website content and documentation.
Inside compromised Microsoft environments, stolen application credentials allowed them to manage accounts and licenses. They also misused SharePoint and OneDrive storage to host campaign material.
Consequently, the operation could support phishing activity through legitimate cloud services.
Phishing Kits Offered Thousands of Impersonation Templates
The phishing platforms supplied familiar lures, including unpaid tolls, traffic fines, delivery issues and account-verification requests.
However, their functionality extended beyond convincing messages. They also used geographic restrictions, fake CAPTCHA pages and IP filtering to obstruct security analysis.
CoGUI initially focused on victims in the United States and Japan. By mid-2026, however, Iron Man had overtaken it.
Iron Man offered more than 2,300 templates impersonating banks, retailers, delivery companies and government agencies. This extensive catalog helped operators adapt campaigns to different markets.
Researchers also examined an exposed code and container registry containing 911 published builds and eight registered accounts.
Separately, they identified a product-selection system connected to payment-card collection. It listed 2,360 phishing packages spanning 130 countries and areas, with updates continuing through October 1, 2026.
Campaigns Sought Credentials, Payment Details and Authentication Tokens
Many messages aimed at Microsoft 365 customers used device-code phishing to obtain authentication tokens.
Meanwhile, earlier investigations identified CoGUI email campaigns consistently targeting Japan from late 2024. Those messages impersonated recognizable Japanese businesses and international organizations to steal login credentials and payment information.
Further analysis uncovered more than 17,000 domains associated with three kits: CoGUI, CoAceV and CoFish_Ws.
The findings demonstrated the operators’ capacity to purchase, maintain and replace phishing infrastructure at considerable scale.
Global Phishing Takedown Blocks Accounts and Domains
A court order from the Southern District of Florida authorized action against domains supporting the operation.
Under that order, Microsoft and Health-ISAC seized and redirected domains connected to YAM Store, CoGUI and Iron Man.
Microsoft also deactivated more than 20,000 accounts associated with YAM Store. Additionally, it blocked 100,000 domains used for impersonation and fraud.
The wider investigation involved Japanese authorities, JC3, cybersecurity researchers and infrastructure providers, alongside blockchain-analysis specialists.
Further infrastructure removal remains underway as investigators act on their findings. Although the action disrupted major resources supporting the network, it does not establish that all related phishing activity has stopped.
0 responses to “Global Phishing Takedown Disrupts Network Behind Over 1 Billion Malicious Messages”