Law enforcement disrupts network behind 1 billion phishing messages

Law enforcement agencies and partners have disrupted a massive cybercriminal ecosystem that facilitated more than one billion malicious messages. This network targeted over 75,000 organizations across 150 countries, with Microsoft reporting that more than 750 million of these messages aimed at its customers via email and SMS since the start of the year.

What infrastructure fueled this campaign?

Investigations initiated by Microsoft and Japan’s National Police Agency traced the activity to YAM Store, also tracked as Storm-3119. This underground marketplace sold compromised or fraudulently obtained Microsoft and Google environments, including accounts, licenses, and storage. Operators acquired expired domains from real organizations, rebuilt websites to make defunct entities appear active, and used those identities to obtain cloud accounts.

Another method involved generating fake organizations complete with content and documentation using AI tools. In compromised Microsoft environments, operators used stolen application credentials to manage accounts and licenses. They abused SharePoint and OneDrive storage for hosting malicious content, leveraging the trust associated with legitimate cloud providers to deliver attacks.

Which tools were used for phishing?

YAM Store linked to several phishing kits, collectively tracked as Storm-2990, including CoGUI, Haozi, and Iron Man System. These kits offered a broad range of lures, such as unpaid tolls, traffic penalties, delivery problems, and account verification requests. The tools supported geofencing, fake CAPTCHA gates, and IP filtering to obstruct security analysis and prevent automated scanning.

Microsoft noted that CoGUI primarily targeted victims in the United States and Japan. However, Iron Man System, which offers over 2,300 templates impersonating banks, retailers, delivery services, and government agencies, surpassed CoGUI by mid-2026. Cybersecurity firm Resecurity analyzed exposed infrastructure, including a publicly exposed Git container registry with 911 published builds.

How did the operators scale their efforts?

Resecurity identified a product-selection subsystem linked to payment-card capture within the Iron Man System infrastructure. This subsystem cataloged 2,360 phishing packages covering 130 countries and areas, with updates continuing through October 1, 2026. The sheer volume of templates and the use of AI to generate realistic organizational content allowed operators to maintain a high volume of diverse, convincing attacks.

The combination of stolen legitimate cloud infrastructure and sophisticated, frequently updated phishing kits created a resilient ecosystem. By using real Microsoft and Google accounts, attackers bypassed traditional sender reputation filters, making the malicious messages appear more legitimate to both users and security systems.

What should security teams monitor?

Security teams should scrutinize cloud account provisioning logs for unusual activity, particularly from expired domains or newly created entities. Monitor for the use of stolen application credentials to manage licenses or storage. Look for signs of AI-generated content in phishing attempts, such as generic but plausible organizational documentation.

Check for geofencing behaviors in incoming traffic, where access is restricted based on location to avoid detection. Review SharePoint and OneDrive usage for unauthorized hosting of external content. Ensure that multi-factor authentication is enforced for all administrative accounts to prevent credential theft from escalating to full environment compromise.

Detection notes

Teams usually identify this activity by reviewing cloud audit logs for unexpected account creations or license modifications from unfamiliar IP addresses. Check whether storage services like SharePoint or OneDrive are hosting executable files or login forms, which is atypical for standard business use. Look for spikes in failed login attempts followed by successful access using application credentials. Monitor email gateways for messages originating from domains that recently changed ownership or have minimal DNS history. Containment moves should focus on revoking suspicious application permissions and isolating compromised cloud accounts immediately.

Background: Multi-factor authentication

Multi-factor authentication adds a second verification step, making stolen credentials useless on their own. It blocks automated attacks but cannot stop social engineering, session hijacking, or insider threats. It is worth it for any account with access to sensitive data or financial controls.

Read the full guide: Multi-Factor Authentication: Real Benefits and Hidden Failure Modes

What to do and how to stay safe: Microsoft

• Review cloud environment logs for unauthorized account creations or license changes, especially from expired domains.
• Enforce multi-factor authentication on all administrative and service accounts to mitigate the impact of stolen credentials.
• Monitor email and SMS traffic for lures related to traffic penalties, delivery issues, or urgent account verification requests.
• Scan cloud storage services like OneDrive and SharePoint for unauthorized hosting of login pages or executable files.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many malicious messages were sent by this network?

The disrupted ecosystem facilitated more than one billion malicious messages, with over 750 million aimed at Microsoft customers.

Which phishing kits were involved in the takedown?

The investigation linked the activity to CoGUI, Haozi, and Iron Man System, collectively tracked as Storm-2990.

What methods did operators use to obtain cloud accounts?

Operators acquired expired domains of real organizations, rebuilt websites, and used AI tools to generate fake organizations with documentation.