Full Report
Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. Threat actors purchased and used these tools and infrastructure, including phishing kits and access to compromised or fraudulent Microsoft or Google cloud…
Analysis Summary
# Threat Actor: YAM Store (Microsoft tracking designation Storm-3119) and Associated Chinese-Language Phishing Ecosystem
## Attribution & Identity
- **Primary name:** YAM Store, an underground marketplace tracked by Microsoft as **Storm-3119**.
- **Ecosystem type:** A Chinese-language cybercriminal ecosystem rather than a single threat group. Microsoft describes it as an interconnected network of three roles:
- **Phishing kit developers** who build the kits.
- **An infrastructure dealer** who sells supporting infrastructure.
- **Threat actors** who buy from the developers and dealer and run campaigns.
- **Aliases:** The article names no additional aliases. Microsoft's broader "Storm-" naming convention applies to Storm-3119.
- **Attribution basis:** Language of the marketplace and kits (Chinese), and the commercial nature of the ecosystem. The article does not name individuals or state a national-level sponsor, so this is a financially motivated cybercriminal operation.
## Activity Summary
- Microsoft observed the ecosystem over roughly a year. Its research began with one phishing kit sold through YAM Store, which led to the wider network of developers, the infrastructure dealer, and buyers.
- Buyers used the kits and resources to conduct large-scale phishing against organizations in multiple sectors and countries.
- Resources sold or used included:
- Phishing kits.
- Access to compromised or fraudulent **Microsoft or Google cloud environments**.
- Related credentials.
- In collaboration with law enforcement and other partners, Microsoft's **Digital Crimes Unit (DCU)** disrupted the ecosystem's primary developers and infrastructure.
- Microsoft's blog examines the kits' technical aspects, shared infrastructure, provisioning methods, and downstream activity by buyers.
## Tactics, Techniques & Procedures
- **Phishing kit-as-a-service:** Turnkey kits sold through an underground marketplace, lowering the skill needed to run campaigns.
- **Use of compromised or fraudulent cloud tenants:** Abuse of Microsoft and Google cloud environments to host or send phishing activity and to appear legitimate.
- **Credential harvesting and reuse:** Use of stolen or purchased credentials to access targets' accounts.
- **Shared, provisioned infrastructure:** Infrastructure supplied by a dealer and reused across buyers, which links otherwise separate campaigns.
- **Specific MITRE ATT&CK IDs:** Not provided in the article. The following are *inferred* mappings for reference only:
- T1566 (Phishing), with likely sub-techniques for spearphishing or link-based delivery.
- T1078 (Valid Accounts), for use of compromised or fraudulent cloud credentials.
- T1588.003 (Obtain Capabilities: Code Signing Certificates) or T1587 (Develop Capabilities), depending on how kits are built and sourced.
- T1583 (Acquire Infrastructure), for the infrastructure dealer's role.
- T1656 (Impersonation), if kits impersonate Microsoft or Google sign-in pages.
## Targeting
- **Sectors:**
- Healthcare
- Financial services
- Wholesale distribution
- Information technology (IT)
- **Geography:**
- Japan
- United States
- Australia
- India
- The article notes the ecosystem enables operations "worldwide," so targeting is not limited to these countries.
- **Victims:** The article does not name specific organizations.
## Tools & Infrastructure
- **Malware families:** None named. The threat centers on phishing kits and cloud-based access rather than traditional malware.
- **Phishing kits:** Several kits marketed and sold through YAM Store, though the article does not name them.
- **Infrastructure:** Shared infrastructure from a dealer, plus compromised or fraudulent Microsoft and Google cloud accounts. No specific C2 domains or IPs are given in the article.
- **Reference link (defanged):** hxxps[://]aka[.]ms/YamCOGUIIronMan (the DCU disruption write-up)
- **Primary source (defanged):** hxxps[://]www[.]microsoft[.]com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/
## Implications
- **Commoditization of phishing:** The kit-and-infrastructure model lets low-skill buyers run large campaigns, so the threat is broad rather than concentrated in a few sophisticated actors.
- **Abuse of trusted cloud platforms:** Using legitimate Microsoft and Google environments helps malicious traffic and sign-in attempts evade reputation-based controls.
- **Credential-based access:** Purchased cloud credentials can bypass perimeter defenses, making identity the primary attack surface.
- **Multi-sector risk:** Healthcare and financial services are high-value targets, and wholesale distribution and IT firms can serve as entry points into supply chains.
- **Disruption is partial:** The DCU action removed the primary developers and infrastructure, but the article implies buyers and kit ecosystems can recover or be replaced, so the threat is likely to persist in some form.
- **Overall assessment:** High likelihood of continued phishing activity across the targeted sectors and countries. Impact is significant because successful access can enable data theft, fraud, and further intrusion.
## Mitigations
- **Enforce phishing-resistant MFA** (FIDO2 security keys or passkeys) for cloud and email accounts, since the ecosystem sells credentials and session access.
- **Monitor for anomalous cloud sign-ins**, including unfamiliar locations, impossible travel, new devices, and unusual OAuth app consents.
- **Restrict and review OAuth application consent** to limit abuse of malicious or fraudulent cloud integrations.
- **Apply Conditional Access policies** that block legacy authentication and require compliant devices for sensitive resources.
- **Harden email defenses:** Enable anti-phishing policies, Safe Links and Safe Attachments equivalents, and DMARC, DKIM, and SPF enforcement.
- **Run phishing awareness training** focused on credential-harvesting pages that mimic Microsoft or Google login flows.
- **Audit cloud tenants and third-party access** for signs of compromise or unauthorized accounts, and rotate credentials that may have been exposed.
- **Track and block known malicious infrastructure** using vendor threat intelligence and Microsoft's published indicators once they are available.
- **Report suspected phishing** to national CERTs and law enforcement, and share intelligence with sector ISACs.
*Note: The source article is a partial excerpt that repeats Microsoft's blog summary. It does not include technical indicators, kit names, or MITRE mappings. For those details, consult the full Microsoft Threat Intelligence report.*