Microsoft dismantles Yam Store, a phishing marketplace behind 1 billion malicious messages

Microsoft’s dismantling of Yam Store strikes at the supply chain behind phishing campaigns: a marketplace that sold ready-made attack kits and fraudulently obtained infrastructure to other operators. Microsoft said the operation, executed Wednesday under an order from the US District Court for the Southern District of Florida, seized domains and disabled more than 20,000 accounts tied to Yam Store.

Microsoft described Yam Store as a coordinated underground network dealing in commercial phishing-as-a-service, or PhaaS. The marketplace sold pre-made kits that cybercriminals could buy and deploy to steal data and credentials.

Since January 2026, Yam Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages aimed at over 75,000 organisations worldwide, Microsoft said. More than 750 million messages from Yam Store and the phishing kit brands linked to it were directed at Microsoft customers alone.

The marketplace had also hijacked legitimate Microsoft 365 education and nonprofit cloud tenants.

Yam Store sold fraudulently obtained infrastructure to the developers of three phishing kit brands that Microsoft groups under Storm-2990: CoGUI, also marketed as NX and FA; Haozi, also known as Phoenix; and Iron Man System. Microsoft assessed with high confidence that Chinese-speaking threat actors developed all three brands.

The investigation took nearly a year and began with a tip from Japanese authorities. Microsoft said it worked with international authorities, technology companies and cybersecurity companies, using AI-assisted analysis to identify infrastructure behind the operation.

The partners included Health-ISAC, Japan’s National Police Agency, Japan’s Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.

Microsoft said Yam Store created fraudulent organisations to support its activity. In one case, it used AI-generated content and forged documents to fabricate a fake nonprofit called “Jewish Choice” with a.org domain.

The company said it had dismantled a criminal marketplace responsible for 1 billion malicious messages. It continues to block more than 100,000 domains used for impersonation and fraud.