Microsoft disrupts cryptocurrency-accepting phishing network targeting 75,000 organizations

On October 14, 2026, Microsoft and international partners disrupted a Chinese-language cybercrime network that sent over one billion phishing messages to 75,000 organizations. Under a U.S. court order, authorities seized domains and disabled over 20,000 accounts linked to YAM Store, an underground marketplace selling hijacked Microsoft 365 cloud tenants to phishing kit operators using USDT, USDC, and fiat payment channels.

Microsoft enforcement and disruption

• ▪Microsoft disabled over 20,000 accounts tied to YAM Store and began blocking more than 100,000 domains used for impersonation and fraud
• ▪Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC disrupted a Chinese-language cybercrime ecosystem on October 14, 2026

Scale and revenue of the network

• ▪The disrupted YAM Store phishing network routed over one billion phishing emails and text messages targeting more than 75,000 organizations across at least 150 countries since January 2026
• ▪Operators of the YAM Store, CoGUI, and Iron Man phishing ecosystem, tracked by Microsoft as Storm-2990, earned tens of millions of dollars prior to Microsoft's October 14, 2026 enforcement action

Cryptocurrency processing and asset recovery

• ▪Blockchain intelligence firm TRM Labs assisted law enforcement and private partners in locating and freezing cryptocurrency assets linked to YAM Store
• ▪YAM Store accepted cryptocurrency payments including Tether (USDT) on the TRC20 network and Ethereum, while marketplace offerings were also purchasable using USDC, Alipay, and WeChat Pay

Fraudulent acquisition of cloud tenants

• ▪YAM Store fabricated fake nonprofit organizations, including a entity named Jewish Choice with a .org domain, using AI-generated content and forged documentation to obtain Microsoft cloud tenants
• ▪Underground marketplace YAM Store operated as an initial access broker selling fraudulently obtained Microsoft 365 and Azure for Education cloud tenants to downstream cybercriminals

Technical exploitation of cloud tenants

• ▪YAM Store maintained persistent control over compromised Microsoft 365 tenants by configuring app-only authentication using registered service principals with Microsoft Graph permissions
• ▪YAM Store used automated Flask-based tools routed through Tor alongside central PHP, Java/Spring, and Cloudflare Workers administrative panels to scan and control compromised tenants
• ▪YAM Store converted compromised Microsoft SharePoint and OneDrive storage into sellable cloud hosting using self-provisioned PnP Management Shell service principals

Deployment and operation of phishing kits

• ▪Iron Man System, a phishing kit sold through YAM Store, contained over 2,300 phishing templates targeting more than 130 countries and relayed stolen credentials in real time to operator Telegram accounts via WebSockets
• ▪CoGUI generated over 172 million phishing emails in January 2025 targeting Japanese users before expanding campaign operations to the U.S., Australia, Canada, and New Zealand
• ▪Three Chinese-developed phishing kit brands operating under Storm-2990 — Iron Man System, CoGUI, and Haozi — purchased infrastructure from YAM Store to deploy phishing campaigns
• ▪Iron Man System, a phishing kit sold through YAM Store, relied on GoFrame framework hosting in China and required continuous connection to a vendor licensing server to remain operational

Downstream attacks by Storm-2990

• ▪Threat actors associated with Storm-2990 used device code phishing abusing OAuth 2.0 authentication flows to capture long-lived access tokens that persist after password resets
• ▪Threat actors associated with Storm-2990 engaged in financial fraud by using stolen payment data to purchase high-end goods and conduct unauthorized financial transactions

International investigation and coalition response

• ▪A Microsoft-led international enforcement coalition included Health-ISAC, Cloudflare, Oracle, Proofpoint, Resecurity, TRM Labs, and Japan's Cybercrime Control Center
• ▪Cloudflare suspended account infrastructure linked to YAM Store, disabled Workers projects supporting phishing pages, banned associated domains, and inserted security warnings on active links
• ▪Japan's National Police Agency triggered Microsoft's investigation into YAM Store in late 2025 after alerting Microsoft to cybercrime campaigns targeting Japanese organizations and consumers