The ecosystem combines phishing kits with an underground marketplace selling compromised cloud environments, enabling attacks against organizations in more than 150 countries.
Microsoft has uncovered a cybercrime supply chain that combines phishing-as-a-service kits with an underground marketplace selling compromised cloud environments, enabling criminals to send more than one billion phishing emails and SMS messages to over 75,000 organizations since January 2026.
The ecosystem targeted organizations across healthcare, financial services, wholesale distribution and information technology in India, Japan, the United States and Australia, Microsoft Threat Intelligence and its Digital Crimes Unit said in a report published October 14. Microsoft said its Digital Crimes Unit, working with law enforcement agencies and industry partners, had disrupted the network’s primary developers and infrastructure.
The investigation links three phishing kits — CoGUI, Haozi and Iron Man System — to an underground marketplace called YAM Store. The kits provide ready-made phishing templates and credential-stealing capabilities, while the marketplace supplies access to compromised or fraudulently obtained Microsoft and Google cloud environments, accounts and storage.
The findings show how cybercriminals can buy both the infrastructure and the tools needed to conduct attacks, reducing the need to build and maintain their own operations.
“The business model behind these campaigns gives attackers room to fail,” said Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ. “They can buy replacement infrastructure and keep trying without rebuilding an operation from scratch.”
A market for compromised cloud access
Microsoft tracks YAM Store as Storm-3119 and the developers behind the phishing kits as Storm-2990. The marketplace acted as an initial access broker, acquiring and reselling cloud environments, accounts, licenses and storage to other criminal operators.
Microsoft found that the marketplace used automated reconnaissance to identify cloud-enabled organizations and take over Microsoft 365 and Azure for Education environments. Its operators used stolen application credentials to administer compromised tenants, assign licenses and grant privileged access.
The investigation also uncovered the abuse of SharePoint and OneDrive storage to support phishing operations. The marketplace offered infrastructure associated with legitimate, expired or previously used organizational identities, helping criminal customers obtain environments that could appear credible.
The phishing kits supplied the downstream attack capabilities. Iron Man System alone contained more than 2,335 templates tailored to over 139 countries, impersonating organizations in sectors including government, healthcare, finance, transportation and retail. The kits also used techniques such as geofencing, fake CAPTCHA checks and IP address filtering to complicate automated analysis by security researchers.
Costis said the cloud access described in Microsoft’s report presents a particular challenge because it can persist independently of an individual user’s sign-in session.
Microsoft documented the use of a compromised client secret and application-only authentication to administer cloud environments. Such access can allow an attacker to retain administrative capabilities even after a user changes their password.
“Resetting a user’s password alone could leave this separate route open,” Costis said. Defenders need to establish whether the unauthorized access remains after remediation, including whether compromised credentials and permissions have been revoked.
He added that security teams could use adversarial exposure validation to test whether their controls detect and block similar attempts to abuse application access. Removing a phishing site or blocking an email, he said, does not necessarily resolve the underlying exposure.
Device-code phishing complicates response
Microsoft also observed attackers using device-code phishing, a technique that tricks victims into authenticating to a legitimate application so attackers can obtain authentication tokens and access their accounts.
The technique can undermine the assumption that reaching a genuine sign-in page means an authentication request is safe. The victim may be interacting with a legitimate service while unknowingly authorizing access initiated by an attacker.
“An employee can reach a genuine sign-in page and still be helping an attacker,” said Ross Filipek, CISO at Corsica Technologies.
Filipek advised employees not to enter a device code or approve a multifactor authentication request unless they initiated the login or device setup themselves. A familiar sign-in page, he said, does not establish who is requesting access.
If an employee has already approved a suspicious request, incident responders should revoke active sessions and access tokens, including refresh tokens, and reset the password. Suspected continued misuse may also require disabling the account, he said.
The consequences can extend beyond the compromised identity. Criminals using a company’s cloud environment to distribute phishing messages could exploit its reputation to deceive customers and business partners, increasing the risk of business email compromise, reputational damage and potential legal exposure.
Defenders must verify remediation
The report highlights the need for organizations to investigate cloud identities, application permissions and authentication tokens alongside email-based threats. Microsoft’s findings suggest that disrupting individual phishing domains may have limited lasting effect if attackers can obtain replacement infrastructure through the same commercial network.
Microsoft recommends strengthening identity controls through phishing-resistant multifactor authentication, passkeys, conditional access policies and least-privilege permissions. It also advises organizations to train employees to identify suspicious requests and verify urgent messages through trusted channels rather than following embedded links.
For incident responders, the priority is to confirm that an attacker has lost access, not simply that the initial phishing attempt has been blocked.
“Incident response must also verify that the specific compromised credentials and unauthorized permissions have been revoked,” Costis said. “Otherwise, teams risk closing the incident while leaving a route back in place.”
