A law enforcement and industry coalition led by Microsoft has dismantled one of the largest phishing supply chains uncovered in recent years. The Yam Store phishing network sold compromised Microsoft and Google accounts, cloud storage, and complete attack kits to criminals around the world. Its tools reportedly sent more than a billion malicious messages. For business owners who assume phishing is someone else's problem, this case is a useful reminder: the infrastructure behind these attacks is now a commercial product, sold off the shelf to anyone willing to pay.
What the Yam Store Phishing Network Actually Did
Microsoft and Japan's National Police Agency began investigating a wave of fraudulent activity. They traced it back to an underground marketplace known as Yam Store, tracked under the identifier Storm-3119. That marketplace fed three phishing kits collectively labeled Storm-2990: CoGUI, Haozi, and Iron Man System.
Yam Store did not just sell stolen credentials. It sold entire operating environments: compromised or fraudulently obtained Microsoft and Google accounts, licenses, and storage space, ready for criminals to plug into a campaign. Operators built credibility for these accounts in a specific way. They bought expired domains that once belonged to real organizations, rebuilt the old websites so they appeared active, and used that rebuilt identity to register new cloud accounts. Some fake organizations, complete with content and supporting documentation, were reportedly generated with AI tools, which made them harder to flag as obviously fraudulent.
Once inside compromised Microsoft environments, operators used stolen application credentials to manage accounts and licenses. They also abused SharePoint and OneDrive storage to host phishing pages and payloads, since traffic to those platforms looks ordinary to most filters.
Why the Iron Man Kit Stood Out
Of the three kits, Iron Man System became the dominant tool by the middle of 2026, overtaking CoGUI. According to Microsoft, it offered more than 2,335 templates impersonating banks, retailers, delivery companies, and government agencies. Resecurity's own direct analysis of the kit found 2,360 distinct phishing lure packages. The kit also supported geofencing, fake CAPTCHA gates, and IP filtering, making the pages harder for security researchers to analyze.
Resecurity, which took part in the investigation, found a publicly exposed Git and container registry tied to the kit. It contained 911 published builds and a catalog of phishing packages covering around 130 countries or regions, with updates as recent as October 2026. That scale looks closer to a software product release cycle than to a one-off criminal campaign. It explains why the kits could be resold and customized so widely.
The Scale of the Problem
According to Microsoft, more than 750 million malicious messages aimed at Microsoft 365 customers were observed via email and SMS this year alone. Earlier research from Proofpoint in late 2024 had already flagged CoGUI-linked campaigns targeting Japan consistently. These campaigns impersonated well-known local and international companies to steal credentials and payment data. Investigators later found more than 17,000 domains used across CoGUI and related kits named CoAceV and CoFish_Ws.
A recurring technique across these kits was device-code phishing, where a victim is tricked into approving a sign-in code on a genuine Microsoft login page. The resulting token comes from the real authentication service. Because of that, it can slip past some conventional password and MFA protections, which is why this attack type deserves specific attention in security awareness training.
How the Takedown Worked
Acting under an order from the U.S. District Court for the Southern District of Florida, Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) seized and redirected domains supporting Yam Store, CoGUI, and Iron Man. Microsoft also disabled more than 20,000 accounts tied to Yam Store and blocked 100,000 domains used for impersonation and fraud. The effort involved several additional partners:
- Japanese authorities and the JC3 information-sharing body
- Cloudflare and Oracle, for infrastructure takedown support
- Proofpoint, for threat intelligence on prior campaigns
- TRM Labs, for tracing financial flows
Additional infrastructure is reportedly still being removed as the investigation continues.
What This Means for Your Business
A takedown of this size disrupts a large chunk of active infrastructure, but it does not retire the underlying techniques. The templates, tooling, and criminal know-how will resurface under new names. Here are practical steps worth reviewing this quarter.
| Area to check | Why it matters |
|---|---|
| Legacy or device-code login flows | Common entry point for this attack family |
| MFA method in use | SMS codes are weaker than phishing-resistant options |
| Staff training topics | Toll, delivery, and invoice lures were most common |
| SharePoint/OneDrive sharing activity | Used to host phishing pages inside trusted platforms |
| Application permissions on vendor accounts | Stolen app credentials were a key entry point here |
If your team is assessing exposure across email, cloud storage, and finance workflows, our cybersecurity services team can walk through configuration gaps without assuming the worst case up front. For companies running Odoo alongside Microsoft 365 or Google Workspace, access control questions often extend into the ERP layer too. That is part of why we treat authentication reviews as a cross-system exercise rather than a single-platform checklist during our Odoo ERP support services engagements.
A Limitation Worth Naming
Domain seizures and account suspensions slow an operation down, but they rarely eliminate the criminal group behind it. The people who built and sold these kits can rebuild infrastructure under new branding. The AI-assisted fake organization technique described in the report suggests future variants may be even harder to distinguish from legitimate businesses at a glance. Treat this takedown as a reason to tighten your own defenses now, not as a reason to assume the threat has passed.
If your business also handles finance or customer data through Odoo, a broader review of API integration services can surface similar permission gaps between connected systems. If you want a second opinion on your current email and identity setup, our contact page is the fastest way to reach the team directly.
