Microsoft takes down YAM Store, a phishing kit market
With Health-ISAC, the company moved against three kits that, it says, enabled over a billion messages in 2026; it admits this is only part of the network.
On Oct. 14, 2026, Microsoft said it had shut down part of a Chinese-language phishing network, meaning messages that impersonate a company to steal passwords. The action hit YAM Store, an underground marketplace, and three kits used to build fake login pages. According to Microsoft, those kits enabled more than a billion fraudulent emails and text messages since January 2026, aimed at more than 75 000 organizations.
The company's Digital Crimes Unit worked with Health-ISAC, a group that collects and shares data on threats to the health sector, Japan's National Police Agency and the firm Resecurity. Help Net Security reports that a federal judge in the Southern District of Florida allowed the seizure or redirection of the domains of YAM Store and of CoGUI and Iron Man, two of the three kits. Japanese police had alerted Microsoft in late 2025. For its part, Microsoft says it disabled more than 20 000 accounts tied to YAM Store and keeps more than 100 000 domains blocked that were used to impersonate other companies.
YAM Store, which Microsoft tracks as Storm-3119, sells access to compromised or fraudulent Microsoft and Google cloud environments. The kits are developed by another group, Storm-2990:
- CoGUI, also called NX or FA.
- Haozi, also called Phoenix.
- Iron Man System, advertised on YAM Store since June 2026, with more than 2,335 templates aimed at more than 139 countries, led by the United States.
Victims are in health care, financial services, wholesale distribution and information technology, mostly in Japan and the United States, and also in Australia and India. According to Microsoft, the kits include geographic filters and fake CAPTCHAs, and send Telegram alerts when someone falls for it so the attacker can watch live. Payment was taken in cryptocurrency, Alipay and WeChat Pay. On the scammers, the company holds that the businesses supplying them are what makes the fraud possible. Anyone who buys a kit like this does not need to know how to build the fake pages.
For people who receive these messages, nothing changes right away: phishing does not disappear because of this blow. Microsoft recommends confirming an urgent request with the supposed sender through a channel already known, and never through the link received. It also suggests passkeys and multi-step authentication, and asks companies for a phishing-resistant method on privileged accounts. All of that comes from the manufacturer, not a third party.
The company itself admits that what was disabled is only one stretch of the ecosystem and that the investigation continues. The sources consulted mention no arrests, charges or identified operators, and no estimate of losses. The figures for messages and organizations are the company's and have no independent verification. There is also no data on victims in Mexico.
