The Hidden Network Inside the Phishing Infrastructure Ecosystem Powering Global Cybercrime
The Hidden Network: Inside the Phishing Infrastructure Ecosystem Powering Global Cybercrime
🚨 Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing. This ecosystem enables cybercriminal operations worldwide.
Threat actors purchased and used these tools and infrastructure, including phishing kits and access to compromised or fraudulent Microsoft or Google cloud environments and related credentials. They targeted organizations across various sectors, including healthcare, financial services, wholesale distribution, and information technology (IT) in countries like Japan, the United States, Australia, and India.
In collaboration with law enforcement agencies and other partners worldwide, Microsoft’s Digital Crimes Unit (DCU) facilitated a disruption of the ecosystem’s primary developers and infrastructure.
Key Findings
Microsoft, alongside industry partner Resecurity, identified three phishing kits sold through the YAM Store that make up this Chinese-language cybercriminal network: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System. Microsoft tracks the cluster of activity and the developers behind all three phishing kits as Storm-2990.
Since January 2026, the threat actors behind these kits have been responsible for sending over one billion phishing emails and SMS messages to more than 75 thousand organizations worldwide. Microsoft assesses with high confidence that these phishing kits were developed by Chinese-speaking threat actors. Despite their distinct branding and separate Telegram-based sales channels, they exhibit highly similar capabilities and functionality.
The phishing kits provide templates impersonating legitimate brands and organizations (including government, financial, and logistics) worldwide, enabling criminal actors to facilitate high-volume phishing and credential-stealing operations.
YAM Store Marketplace
These phishing kits have been advertised through YAM Store, an underground marketplace tracked by Microsoft as Storm-3119, with CoGUI and Haozi appearing first, followed by Iron Man System starting in June 2026. YAM Store is an initial access broker (IAB) that sells infrastructure using compromised or fraudulently obtained environments in providers like Microsoft and Google.
The YAM Store marketplace provides cybercriminals with a platform to purchase fraudulently acquired Microsoft and Google domains associated with legitimate, expired, or previously used organization numbers. This allows actors to use seemingly legitimate infrastructure and obtain workspaces at relatively low cost. YAM Store and affiliated phishing kit companies accepted payments through cryptocurrency, including USDT and Ethereum, adding another layer to conceal illicit activity.
The scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses.