Threat reportPhishingTL-2026-3509
Microsoft Disrupts Three Chinese Phishing-as-a-Service Platforms: YAM Store, CoGUI, Iron Man (Storm-2990 / Storm-3119)
Microsoft Disrupts Three Chinese Phishing-as-a-Service (TL-2026-3509), also tracked as Chinese-language phishing-as-a-service ecosystem, is a high-severity phishing campaign, first published 2026-10-14. It is attributed to Storm-2990 with medium confidence, affects Microsoft Microsoft 365 / Azure for Education tenants (abused for, maps to 31 MITRE ATT&CK techniques (T1036.005, T1056.003, T1078.004), and is covered by 9 detection rules and 65 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 31MITRE ATT&CK
- Actors
- 2Storm-2990
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 65Indicators of compromise
Key facts for TL-2026-3509
- Threat ID
- TL-2026-3509
- Also known as
- Chinese-language phishing-as-a-service ecosystem, Storm-2990 phishing kits
- Severity
- HIGH
- Status
- MONITORING
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- Storm-2990, Storm-3119
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- health, finance, logistics, information-technology, government administration, retail, telecoms, consumers
- Target regions
- japan, North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 65
- Updates
- 2026-10-14 · 4 updates · revalidated 4× · latest source
Malware and tooling in Microsoft Disrupts Three Chinese Phishing-as-a-Service
Malware and tooling: CoGUI, Haozi, Iron Man, RIP (Phoenix) Ransomware, Storm, Iron Man licensing server contact
How Microsoft Disrupts Three Chinese Phishing-as-a-Service works
Microsoft and Health-ISAC, under a U.S. District Court (S.D. Florida) order, seized and redirected domains supporting three Chinese-language cybercrime services: YAM Store (a marketplace for compromised or fraudulent Microsoft/Google cloud tenants and accounts), and the CoGUI and Iron Man phishing kits. Per the reporting, the ecosystem delivered 1B+ email/SMS lures since January 2026 (750M+ aimed at Microsoft customers), impersonating 75,000+ organizations across 150+ countries.
On 2026-10-14 Microsoft's Digital Crimes Unit announced a disruption of a Chinese-language phishing ecosystem. Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC (which joined the civil action because of the healthcare targeting) seized and redirected domains supporting three services: YAM Store, CoGUI and Iron Man. Microsoft tracks YAM Store as Storm-3119 and the phishing kits (CoGUI, Haozi, Iron Man System) collectively as Storm-2990. Microsoft's investigation began in early 2025; Japan's National Police Agency alerted Microsoft in late 2025. Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, JC3 and U.S./international law enforcement contributed. Operators are not publicly identified; Microsoft notes close collaboration between the platform developers, and reporting describes them as Chinese-speaking threat actors. Operators reportedly earned tens of millions of dollars.
YAM Store acted as an initial-access/infrastructure marketplace selling compromised or fraudulently obtained Microsoft 365 tenants, Azure for Education environments, Google environments, accounts, licenses and storage. Its operators acquired expired domains of real organizations, rebuilt websites so defunct entities appeared active, and used those identities (including AI-generated fake organizations with documentation) to obtain cloud accounts; stolen application credentials were used to manage accounts and licenses. Microsoft disabled 20,000+ accounts tied to YAM Store, removed infrastructure hosted on its services and blocked 100,000+ impersonation/fraud domains.
CoGUI, first tracked by Proofpoint (active since October 2024, tracked from December 2024), was described as the highest-volume phishing campaign Proofpoint tracked, with 580M+ emails sent January-April 2025 (172M across 170 campaigns in January), mainly against Japan and also the US, Canada, Australia and New Zealand, impersonating Amazon, Rakuten, PayPal, Apple, tax agencies and banks, plus US toll-payment smishing. Its URLs use conditional redirection on IP/geolocation, browser language, OS, screen resolution and device type, sending non-qualifying visitors to the real brand site. By mid-2026 CoGUI was reportedly being replaced by Iron Man.
Iron Man (Chinese name gangtiexia; earlier iteration Phoenix/Haozi) began being advertised in June 2026; the latest template was added 2026-10-01. Resecurity counted 2,335-2,360 templates covering 130-139 countries (reporting differs; the primary news report cites 2,300+), with US lures mainly impersonating traffic/parking and government bodies. Features reported include real-time credential harvesting with operator-driven interactive prompts and one-time verification code capture, geofencing, fake CAPTCHA gates, IP filtering and anti-analysis obstruction, device-code phishing for authentication-token theft, and periodic contact with a licensing server. Resecurity analysed an exposed Git/container registry with 911 published builds and eight registered accounts. Whalebone's independent analysis reports pricing of 588 USDT for 3 months (June 2026 promotion), backend paths with a 10-character random identifier (e.g. /AbCdEfGhIj/api), hosting favouring Tencent (AS132203) and Alibaba (AS45102) with cheap TLDs, delivery over SMS/RCS/iMessage, manual operator MFA capture and card misuse via e-wallets such as Apple Pay.
No domain list or hashes were published in the sources; the only network indicators found are two IPs from Whalebone's third-party analysis. BeaconBeagle returned no record for either IP. Defenders should hunt brand-impersonation lures (delivery, toll/traffic fine, tax, bank, account verification), device-code authorization abuse in Entra ID, and anomalous activity from newly created tenants.
MITRE ATT&CK techniques used in TL-2026-3509
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1656 Impersonation; T1684.001 Impersonation
Credential Access
T1056.003 Input Capture: Web Portal Capture; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1566 Phishing; T1566.002 Phishing: Spearphishing Link
Command and Control
Persistence
T1098 Account Manipulation; T1098.001 Account Manipulation; T1671 Cloud Application Integration
Execution
T1204.001 User Execution: Malicious Link
Lateral Movement
T1550.001 Use Alternate Authentication Material
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.003 Acquire Infrastructure: Virtual Private Server; T1583.006 Acquire Infrastructure: Web Services; T1584.001 Compromise Infrastructure; T1585 Establish Accounts; T1585.003 Establish Accounts: Cloud Accounts; T1586.003 Compromise Accounts: Cloud Accounts; T1608.005 Stage Capabilities: Link Target
Reconnaissance
T1589.001 Gather Victim Identity Information: Credentials; T1598.003 Phishing for Information: Spearphishing Link
Impact
initial-access
Affected products and versions in Microsoft Disrupts Three Chinese Phishing-as-a-Service
Remediation for Microsoft Disrupts Three Chinese Phishing-as-a-Service
Immediate actions
- Block or hunt for the published IPs 43.162.114.28 and 49.51.186.91 in proxy, DNS and firewall logs
- Alert on delivery/toll/traffic-fine/tax/bank lure messages (email and SMS) impersonating your brand or your users' banks
- Report brand-impersonation domains to registrars and use takedown services for your brand
Workarounds
- Block device code flow with an Entra ID Conditional Access policy
- Use URL detonation and newly-registered-domain blocking at the secure email gateway
Longer-term hardening
- Enforce phishing-resistant MFA (FIDO2/passkeys) since kits capture one-time codes in real time
- Restrict or block the OAuth device-code flow via Conditional Access where not required
- Monitor for newly created or unfamiliar tenants, licenses and accounts sending mail to your users
- User awareness on SMS/RCS/iMessage smishing and QR/link lures
Timeline of Microsoft Disrupts Three Chinese Phishing-as-a-Service
- CoGUI phishing platform becomes active (October 2024 per Proofpoint); tracking by Proofpoint begins in December 2024
- Proofpoint begins tracking CoGUI activity (December 2024, month approximate).
- Proofpoint Emerging Threats rule 2859484 'ETPRO PHISHING CoGUI Phish Landing Page' published (Proofpoint had tracked CoGUI since December 2024).
- CoGUI peaks in January 2025 with 172 million messages across 170 campaigns; 580M+ emails sent January-April 2025, mainly against Japan
- Microsoft investigation into the ecosystem begins in early 2025 (CyberScoop)
- Proofpoint publishes 'CoGUI Phish Kit Targets Japan with Millions of Messages' (about 50 campaigns a month lasting 3-5 days; that CoGUI version captured credentials and cards but not MFA).
- Netcraft publishes analysis of the Haozi PhaaS: roughly $2,000 annual subscription and over $280,000 received in its USDT wallet.
- Japan's National Police Agency alerts Microsoft to the activity (late 2025)
- Storm-2990 kits begin delivering 1B+ email and SMS lures since the start of 2026, with 750M+ aimed at Microsoft customers
- Iron Man phishing kit begins to be advertised (June 2026), reportedly replacing CoGUI by mid-2026
- Start of the window (to 2026-09-17) in which operators of CoGUI, CoAceV and CoFish_Ws used 3,788 unique fully qualified domain names (Proofpoint).
- PhishEye publishes the IronToll analysis of Iron Man System v6.0.0, with C2 on Tencent and Alibaba Cloud and domains rotated every 1-2 days.
- End of the 3,788-FQDN observation window (Proofpoint).
- Latest Iron Man template added, showing the kit remained actively developed up to the takedown
- Microsoft publishes 'The hidden network' research detailing the five-stage YAM Store pipeline (reconnaissance, takeover, storage abuse, phishing infrastructure, monetization); Health-ISAC and JC3 issue statements.
- Proofpoint publishes its view of the disruption: CoGUI, CoAceV and CoFish_Ws (1,081 / 242 / 19 campaigns; 66 brands impersonated, mostly Japanese) linked to YAM Store and Iron Man; JC3, Resecurity, Cloudflare, Oracle and TRM Labs credited as partners.
- Microsoft and Health-ISAC announce seizure and redirection of YAM Store, CoGUI and Iron Man domains under a U.S. District Court (S.D. Florida) order; 20,000+ YAM Store accounts disabled and 100,000+ domains blocked
Update history for TL-2026-3509
- 2026-10-14 — Microsoft Disrupts Storm-2990 Phishing Kits (CoGUI, Haozi, Iron Man System) and Storm-3119 YAM Store Linked to Over 1 Billion Scam Messages: What changed No severity, exploitability or status change. The newer report restates the same takedown with additional detail from Microsoft's primary research. New indicators (7) 7 new indicators: YAM Store Flask/Tor tenant-recon tool, 'Sh
- 2026-10-14 — Disruption of Major Chinese-Language Phishing Kits (CoGUI, CoAceV, CoFish_Ws) Targeting Japan: What changed No severity, exploitability or status change; the report is enrichment of the existing record, not an escalation. The Proofpoint report's own status of ACTIVE is an analyst judgment about post-takedown activity that is not evid
- 2026-10-14 — Chinese-Language Phishing-as-a-Service Market (CoGUI, Iron Man, Haozi, YAM Store) Behind 1B+ Messages Disrupted by Microsoft: What changed No field escalation; severity HIGH, exploitability ACTIVE, status MONITORING unchanged. The newer report is a consolidated restatement of the same Microsoft disclosure with additional technical detail. New indicators (5) 5 new
- 2026-10-14 — Chinese-language phishing infrastructure ecosystem (Storm-2990 kits CoGUI, Haozi, Iron Man System; Storm-3119 YAM Store) powering global phishing campaigns: What changed No field escalation. Severity (HIGH), exploitability (ACTIVE) and attribution confidence (MEDIUM) already match the newer report. The report's status of ACTIVE vs the existing MONITORING is not backed by new evidence beyond the
Sources cited for Microsoft Disrupts Three Chinese Phishing-as-a-Service
- Microsoft takes down 3 major Chinese phishing platforms
- Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
- Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
- Global takedown hits network behind 1 billion phishing messages
- CoGUI phishing platform sent 580 million emails to steal credentials
- Inside a Global Phishing-as-a-Service Operation (Iron Man analysis)
Detection coverage for TL-2026-3509
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3509 across Splunk SPL, Microsoft KQL and Sigma, covering 65 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.