Microsoft has uncovered a Chinese-language cybercriminal ecosystem comprising an interconnected network of phishing kit operators tracked as Storm-2990 and an illicit marketplace tracked as Storm-3119 that sells tools and infrastructure for large-scale phishing.
Alongside industry partner Resecurity, Microsoft identified three phishing kits sold through the YAM Store that make up this network: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System. These kits are tracked as Storm-2990. The YAM Store has been found to sell Microsoft and Google environments, accounts, licenses, and storage that were obtained fraudulently or through compromise.
Since January 2026, the YAM Store, CoGUI, and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages directed at Microsoft customers alone. Health-ISAC stated that these messages targeted consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.
Microsoft assesses with high confidence that the phishing kits were developed by Chinese-speaking threat actors and exhibit highly similar capabilities and functionality despite distinct branding and separate Telegram-based sales channels.
References
- https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/
- https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/
- https://aka.ms/YamCOGUIIronMan
- https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/
- https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html
- https://cybernews.com/security/microsoft-china-phishing-platforms/