# Microsoft Disrupts Three Chinese Phishing-as-a-Service Platforms: YAM Store, CoGUI, Iron Man (Storm-2990 / Storm-3119)

> Microsoft and Health-ISAC, under a U.S. District Court (S.D. Florida) order, seized and redirected domains supporting three Chinese-language cybercrime services: YAM Store (a marketplace for compromised or fraudulent Microsoft/Google cloud tenants and accounts), and the CoGUI and Iron Man phishing kits. Per the reporting, the ecosystem delivered 1B+ email/SMS lures since January 2026 (750M+ aimed at Microsoft customers), impersonating 75,000+ organizations across 150+ countries.

- **Published:** 2026-10-14T13:40:57Z
- **Last reviewed:** 2026-10-14T19:41:29.972Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3509
- **ID:** TL-2026-3509
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** MONITORING
- **Actor:** Storm-2990
- **Detections:** 9 · **IOCs:** 65 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-14 Microsoft's Digital Crimes Unit announced a disruption of a Chinese-language phishing ecosystem. Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC (which joined the civil action because of the healthcare targeting) seized and redirected domains supporting three services: YAM Store, CoGUI and Iron Man. Microsoft tracks YAM Store as Storm-3119 and the phishing kits (CoGUI, Haozi, Iron Man System) collectively as Storm-2990. Microsoft's investigation began in early 2025; Japan's National Police Agency alerted Microsoft in late 2025. Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, JC3 and U.S./international law enforcement contributed. Operators are not publicly identified; Microsoft notes close collaboration between the platform developers, and reporting describes them as Chinese-speaking threat actors. Operators reportedly earned tens of millions of dollars.

YAM Store acted as an initial-access/infrastructure marketplace selling compromised or fraudulently obtained Microsoft 365 tenants, Azure for Education environments, Google environments, accounts, licenses and storage. Its operators acquired expired domains of real organizations, rebuilt websites so defunct entities appeared active, and used those identities (including AI-generated fake organizations with documentation) to obtain cloud accounts; stolen application credentials were used to manage accounts and licenses. Microsoft disabled 20,000+ accounts tied to YAM Store, removed infrastructure hosted on its services and blocked 100,000+ impersonation/fraud domains.

CoGUI, first tracked by Proofpoint (active since October 2024, tracked from December 2024), was described as the highest-volume phishing campaign Proofpoint tracked, with 580M+ emails sent January-April 2025 (172M across 170 campaigns in January), mainly against Japan and also the US, Canada, Australia and New Zealand, impersonating Amazon, Rakuten, PayPal, Apple, tax agencies and banks, plus US toll-payment smishing. Its URLs use conditional redirection on IP/geolocation, browser language, OS, screen resolution and device type, sending non-qualifying visitors to the real brand site. By mid-2026 CoGUI was reportedly being replaced by Iron Man.

Iron Man (Chinese name gangtiexia; earlier iteration Phoenix/Haozi) began being advertised in June 2026; the latest template was added 2026-10-01. Resecurity counted 2,335-2,360 templates covering 130-139 countries (reporting differs; the primary news report cites 2,300+), with US lures mainly impersonating traffic/parking and government bodies. Features reported include real-time credential harvesting with operator-driven interactive prompts and one-time verification code capture, geofencing, fake CAPTCHA gates, IP filtering and anti-analysis obstruction, device-code phishing for authentication-token theft, and periodic contact with a licensing server. Resecurity analysed an exposed Git/container registry with 911 published builds and eight registered accounts. Whalebone's independent analysis reports pricing of 588 USDT for 3 months (June 2026 promotion), backend paths with a 10-character random identifier (e.g. /AbCdEfGhIj/api), hosting favouring Tencent (AS132203) and Alibaba (AS45102) with cheap TLDs, delivery over SMS/RCS/iMessage, manual operator MFA capture and card misuse via e-wallets such as Apple Pay.

No domain list or hashes were published in the sources; the only network indicators found are two IPs from Whalebone's third-party analysis. BeaconBeagle returned no record for either IP. Defenders should hunt brand-impersonation lures (delivery, toll/traffic fine, tax, bank, account verification), device-code authorization abuse in Entra ID, and anomalous activity from newly created tenants.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1660 Phishing
- T1598.003 Phishing for Information: Spearphishing Link
- T1583.001 Acquire Infrastructure: Domains
- T1608.005 Stage Capabilities: Link Target
- T1585.003 Establish Accounts: Cloud Accounts
- T1586.003 Compromise Accounts: Cloud Accounts
- T1204.001 User Execution: Malicious Link
- T1684.001 Impersonation
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1480 Execution Guardrails
- T1111 Multi-Factor Authentication Interception
- T1528 Steal Application Access Token
- T1657 Financial Theft
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1583.006 Acquire Infrastructure: Web Services
- T1585 Establish Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1098 Account Manipulation
- T1497 Virtualization/Sandbox Evasion
- T1056.003 Input Capture: Web Portal Capture
- T1566 Phishing
- T1098.001 Account Manipulation
- T1671 Cloud Application Integration
- T1550.001 Use Alternate Authentication Material
- T1090.003 Proxy
- T1567 Exfiltration Over Web Service
- T1584.001 Compromise Infrastructure
- T1589.001 Gather Victim Identity Information: Credentials
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1656 Impersonation

## Sources

- [Microsoft takes down 3 major Chinese phishing platforms](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms)
- [Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem](https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/)
- [Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages](https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/)
- [Global takedown hits network behind 1 billion phishing messages](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/)
- [CoGUI phishing platform sent 580 million emails to steal credentials](https://www.bleepingcomputer.com/news/security/cogui-phishing-platform-sent-580-million-emails-to-steal-credentials/)
- [Inside a Global Phishing-as-a-Service Operation (Iron Man analysis)](https://www.whalebone.io/post/inside-a-global-phishing-as-a-service-operation)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3509