Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation
In October 2026, Microsoft led a coalition including Health-ISAC, Japan Cybercrime Control Center, and private sector partners to disrupt three major phishing-as-a-service (PhaaS) kits: CoGUI, Haozi, and Iron Man System. These Chinese-language cybercriminal operations, tracked as Storm-3119 and Storm-2990, facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations across 150+ countries since January 2026. The threat actors leveraged compromised Microsoft and Google cloud environments purchased through the YAM Store marketplace, generating tens of millions in revenue while targeting healthcare, financial, and government sectors globally. This disruption highlights the evolving sophistication of phishing-as-a-service ecosystems that abuse legitimate cloud infrastructure at scale. As organizations increasingly adopt cloud-first strategies, attackers are weaponizing trusted platforms to bypass traditional security controls, making this incident particularly relevant for understanding modern credential theft and initial access broker tactics.
Kill Chain
