Microsoft shuts down underground phishing kit market

Microsoft has shut down a hidden marketplace that sells tools for phishing scams. The site, called YAM Store, was linked to more than a billion spam messages and attacks on over 75,000 companies. The attacks hit hospitals, banks, wholesalers, and IT firms in Japan, the United States, Australia, and India. Microsoft uncovered the marketplace by working with Resecurity and tracing the kits.

Phishing Kits and Cloud Accounts

YAM Store sold three main phishing kits: CoGUI (also known as NX or FA), Haozi (Phoenix), and Iron Man System. Microsoft calls the developers behind these kits Storm‑2990 and the marketplace Storm‑3119. The kits let buyers copy the look of real brands, create landing pages in local languages, and send fake emails and texts. Since January 2026 the kits have helped send more than a billion phishing messages. The templates target specific countries, using trusted names and local language.

The marketplace also sold compromised or fraudulently obtained Microsoft and Google cloud accounts. Operators bought accounts using stolen credentials, reset passwords, and assigned licences, turning the accounts into hosting services. They could host phishing sites in SharePoint and OneDrive and keep control through application‑level access. These services made the phishing campaigns harder to detect and more scalable. Payments for the accounts were made in cryptocurrency to hide the money trail.

Iron Man System offers 2,335 templates for 139 countries, impersonating governments, banks, stores and delivery firms. When a victim enters a password or payment, the operator receives a Telegram message and can monitor the victim’s progress. The kit can block IP addresses, use fake CAPTCHAs, and restrict country access to avoid investigation. Buyers use the stolen data to log into accounts and commit financial fraud. The system therefore gives attackers a powerful real‑time control panel.

Japanese police first alerted Microsoft in late 2025 about scams in Japan. Microsoft tested purchases to confirm how YAM Store worked, finding operators rebuild expired domains and use them to obtain Microsoft 365 accounts. A court order from the Southern District of Florida stopped the marketplace and redirected its domains. Microsoft and Health‑ISAC disabled more than 20,000 accounts and blocked over 100,000 impersonation domains. The move removes a major source of phishing supplies and slows the spread of scam messages.