A Chinese-language phishing ecosystem is behind the deployment of more than a billion emails and SMS messages to tens of thousands of organizations in the past nine months alone.
Microsoft Threat Intelligence and Microsoft Digital Crimes Unit today published research concerning a cybercrime ecosystem dedicated to the tools and infrastructure needed to support phishing campaigns. The research covers phishing kit developers, phishing infrastructure sellers, and the customers of three of these kits.
At the center of the infrastructure side of the operation is Yam Store, a cybercrime marketplace Microsoft tracks as Storm-3119. Yam Store offered multiple phishing kits for sale and, perhaps most novel, Microsoft and Google domains associated with legitimate, expired, or previously used organizations, which allowed threat actors to operate phishing infrastructure that appeared more trustworthy to victims and automated defenses.
The phishing cybercrime ecosystem has picked up significant steam in recent years, facilitated by an influx of kits and services that enable newer threat actors to generate lures, send messages to possible victims at scale, and maintain the infrastructure to exploit stolen data. The rise of large language models (LLMs) exacerbated the issue, as threat actors can now use AI to spin-up convincing phishing sites or generate error-free email lures.
Microsoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System. Microsoft tracks the developers behind these kits, and surrounding activity, as Storm-2990. "Since January 2026, the threat actors behind these kits have been responsible for facilitating the sending of over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide," Microsoft said.