Global law enforcement operation disrupts phishing network behind 1 billion malicious messages

Investigation led by Microsoft and Japan’s National Police Agency takes down a Chinese-language cybercrime marketplace and associated phishing kits

By LineZotpaper

Published15 October 2026

Read Time2 min

A coordinated international operation has disrupted a cybercriminal ecosystem that sent more than a billion phishing messages targeting over 75,000 organizations across 150 countries. Since the start of the year, more than 750 million malicious emails and SMS texts were aimed at Microsoft customers alone.

The investigation, initiated by Microsoft and Japan's National Police Agency (NPA), uncovered a sprawling Chinese-language cybercrime marketplace known as YAM Store (Storm-3119). The marketplace sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage, which were then used to host phishing campaigns.

Operators of YAM Store acquired expired domains of real organizations, rebuilt websites to make defunct entities appear active, and used those identities to obtain cloud accounts. In some cases, they used AI tools to generate fake organizations complete with content and documentation.

Investigators linked YAM Store to three phishing kits—CoGUI, Haozi, and Iron Man System—collectively tracked as Storm-2990. These kits offered cybercriminals a broad range of lures, including unpaid tolls, traffic penalties, delivery problems, and account verification requests. They supported geofencing, fake CAPTCHA gates, IP filtering, and other measures to obstruct security analysis.

Microsoft reported that the CoGUI kit initially targeted victims in the United States and Japan, but by mid-2026 the Iron Man kit had become dominant, offering over 2,300 templates impersonating banks, retailers, delivery services, and government agencies.

Cybersecurity company Resecurity, which also participated in the investigation, analyzed exposed infrastructure belonging to Iron Man, finding a publicly exposed Git/container registry with 911 published builds and eight registered accounts. The researchers identified a product-selection subsystem linked to payment-card capture, cataloging 2,360 phishing templates.

Details of the takedown operation and any arrests have not been disclosed by law enforcement agencies.

Analysis

Why This Matters

The scale of this operation—over a billion messages targeting 75,000 organizations globally—shows how phishing-as-a-service has become an industrial-scale crime.
The use of AI to create fake organizations and the abuse of legitimate cloud services highlight evolving tactics that make phishing harder to detect.
Disrupting the underlying infrastructure marketplace may temporarily reduce the volume of attacks but does not eliminate the criminal business model.

Background

Phishing-as-a-service has grown rapidly in recent years, with underground marketplaces selling everything from email templates to compromised cloud accounts. These services lower the barrier to entry for cybercriminals who lack technical skills, enabling large-scale campaigns that impersonate trusted brands and government agencies. Microsoft has increasingly collaborated with law enforcement agencies worldwide to investigate and disrupt these networks.

Key Perspectives

Law enforcement agencies: The disruption of YAM Store and associated phishing kits removes a key source of infrastructure for cybercriminals. Japan's NPA and international partners gain intelligence on operational methods. Microsoft and Resecurity: By identifying the entire ecosystem—from the marketplace to phishing kit development—security researchers can help defenders recognise and block similar operations in future. Cybercriminals using the platform: They lose access to tested infrastructure and templates, but may migrate to other underground services or rebuild using the same methods discovered in this investigation.

What to Watch

Whether law enforcement announces arrests or asset seizures in connection with the operation.
If other phishing kits and marketplaces emerge to fill the gap left by YAM Store and Storm-2990.
How quickly Microsoft and Google respond to the abuse of their cloud services for account and storage fraud.

Sources

Global takedown hits network behind 1 billion phishing messages — BleepingComputer