Affected Systems

Microsoft 365 and Google Workspace customers globally; 75,000+ organizations across 150 countries targeted by YAM Store (Storm-3119) marketplace and associated phishing kits (CoGUI, Haozi, Iron Man System/Storm-2990). Over 750 million messages sent to Microsoft customers since January 2026.

Exploitation Status

Active campaign disrupted by law enforcement in October 2026. Microsoft seized domains, deactivated 20,000+ accounts, and blocked 100,000 domains. Infrastructure used device-code phishing, compromised cloud environments, and AI-generated fake organizations. Phishing kits included 2,300+ templates impersonating banks, retailers, delivery services, and government agencies.

Business Impact

Organizations using Microsoft 365 and Google Workspace faced credential theft, payment data compromise, and account takeover via device-code phishing. Attackers abused SharePoint/OneDrive for hosting, used stolen application credentials for account management, and leveraged 17,000+ domains for impersonation. Disruption removes immediate threat but residual infrastructure may remain active during ongoing cleanup.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Monitor Microsoft 365 and Google Workspace sign-in logs for device-code authentication flows and anomalous token issuance, especially from unfamiliar locations or devices
  • Review and revoke suspicious OAuth application permissions and service principal credentials in Azure AD/Entra ID and Google Workspace admin consoles
  • Block known malicious domains associated with YAM Store, CoGUI, and Iron Man kits using threat intelligence feeds from Microsoft, Cloudflare, and Proofpoint
  • Enforce conditional access policies requiring phishing-resistant MFA (FIDO2, certificate-based) for all cloud service access, particularly SharePoint and OneDrive
  • Audit cloud tenant licenses and accounts for unauthorized additions or modifications; investigate any expired domain registrations linked to your organization that could be hijacked

---

# Geopolitical Context

Geopolitical Context

The disruption of a Chinese-language cybercriminal marketplace operating at unprecedented scale—delivering over 1 billion phishing messages to 75,000 organizations across 150 countries—illustrates the transnational nature of contemporary cybercrime infrastructure. The investigation, initiated jointly by Microsoft and Japan's National Police Agency, uncovered a sophisticated commercial ecosystem (YAM Store/Storm-3119) provisioning phishing-as-a-service kits (CoGUI, Haozi, Iron Man System/Storm-2990) to a global customer base. The operation's use of AI-generated organizational facades, compromised cloud tenancies, and expired domain resurrection demonstrates advanced tradecraft typically associated with organized cybercrime syndicates. The Chinese-language interface and marketplace structure suggest operational ties to Mandarin-speaking cybercriminal communities, though attribution to state actors remains unestablished. The targeting pattern—with particular focus on U.S. and Japanese victims—and the scale of credential harvesting raise concerns about potential downstream exploitation by espionage-motivated actors who may acquire access through secondary markets.

State Actor Alignment

No direct state attribution has been established for this cybercriminal infrastructure. The Chinese-language marketplace and tooling indicate operational links to Mandarin-speaking cybercriminal ecosystems, but the investigation characterizes this as organized crime rather than state-sponsored activity. The disruption involved coordinated action by U.S. judicial authorities (U.S. District Court for the Southern District of Florida), Japanese law enforcement (National Police Agency, JC3), and private-sector partners including Microsoft, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. The takedown reflects growing international cooperation in countering transnational cybercrime, particularly U.S.-Japan coordination on threats affecting both nations' critical infrastructure and enterprise sectors. The scale of the operation—managing 17,000+ domains and 20,000+ fraudulent accounts—suggests a well-resourced criminal enterprise operating with relative impunity prior to disruption, raising questions about jurisdictional safe havens and enforcement gaps in the Asia-Pacific region.

Business Impacty pro region

The disruption has significant implications for enterprise security across North America, Europe, and Asia-Pacific. The targeting of Microsoft 365 and Google cloud environments—affecting 75,000 organizations globally—demonstrates the vulnerability of widely adopted SaaS platforms to credential-harvesting campaigns. Japanese organizations faced sustained targeting through CoGUI campaigns since late 2024, reflecting Japan's strategic importance as both an economic target and investigative partner. European entities likely featured among the 130 countries/areas covered by Iron Man's 2,360 phishing templates, which impersonated banks, government agencies, and delivery services. The operation's use of device-code phishing and MFA bypass techniques (documented at 258 organizations) undermines trust in authentication controls across the transatlantic business community. The takedown may temporarily reduce phishing volume, but the commercial nature of the ecosystem suggests that competing services or reconstituted infrastructure may emerge. Organizations in sectors frequently impersonated—financial services, logistics, government—face elevated risk during any transition period as threat actors seek alternative platforms.

Forecast

If the disrupted infrastructure remains offline and key operators face prosecution, a temporary reduction in large-scale phishing campaigns targeting Microsoft 365 and Google environments is likely over the next 3-6 months. However, if the underlying Chinese-language cybercriminal community remains intact and operational security lessons are learned, reconstitution of similar phishing-as-a-service platforms under new branding is probable within 6-12 months. If Japanese and U.S. authorities sustain investigative pressure and expand cooperation with regional partners, further disruptions of related infrastructure may follow, potentially fragmenting the ecosystem. If competing phishing-kit providers perceive a market opportunity, accelerated development of alternative platforms with enhanced anti-analysis features is likely. Organizations should anticipate that threat actors currently reliant on the disrupted infrastructure may shift to alternative credential-harvesting methods, including malware-based stealers or direct exploitation of unpatched vulnerabilities, during the transition period. If downstream buyers of harvested credentials include espionage-motivated actors, delayed-onset intrusions using previously acquired access tokens may emerge over the next 12-18 months.