Microsoft Says It Disrupted a Marketplace That Sold Ready-Made Phishing Attacks
Microsoft announced Oct. 14, 2026, that its Digital Crimes Unit has disrupted the main developers and infrastructure behind an underground marketplace that sold phishing tools and the hijacked cloud accounts needed to run them. The company says it worked with law enforcement agencies and other partners.
What the marketplace sold was the attack itself. A phishing kit is a packaged product: ready-made fake sign-in pages and a panel that collects what a victim types, so someone with no technical skill can steal passwords at scale. Microsoft says one of the kits carried more than 2,335 such templates, impersonating banks, delivery firms and police. It says the three kits' operators facilitated more than a billion phishing emails and text messages to over 75,000 organizations since January 2026. No independent measurement of those totals has been published.
Microsoft's post describes the marketplace, which it calls YAM Store, as a broker between two trades. It obtained Microsoft and Google cloud environments that had been hijacked or fraudulently registered, then resold the accounts, licenses and storage to the kit operators. Working with the security firm Resecurity, Microsoft identified the kits as CoGUI, Haozi and Iron Man System. It says the organizations targeted were in healthcare, financial services, wholesale distribution and IT. Most were in Japan, the United States, Australia and India.
Storm-3119 and Storm-2990, Microsoft's names for the marketplace and the kit developers, are its own internal labels for clusters of activity, not identifications of charged people or companies. Microsoft says it assesses with high confidence that the kits were built by Chinese-speaking developers. The post describes no legal steps, names no individuals, and reports no arrests or charges.
Disruptions of phishing services sold as products have become routine rather than exceptional: the same Microsoft unit announced an unrelated action against a different phishing service in September 2026, and infrastructure of this kind is often rebuilt. Microsoft's advice is unchanged by the takedown: check an unexpected message by contacting the sender or the organization directly, never through a link in it, and limit who holds administrator access.
