Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing
Microsoft uncovered a sophisticated Chinese-language cybercriminal ecosystem centered around YAM Store (Storm-3119), an initial access broker selling fraudulently obtained Microsoft 365 and Google cloud environments to phishing kit operators. The operation, tracked as Storm-2990, includes three major phishing kits (CoGUI, Haozi, and Iron Man System) that have facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations worldwide since January 2026. The threat actors primarily targeted healthcare, financial services, wholesale distribution, and IT sectors across Japan, the United States, Australia, and India, using sophisticated evasion techniques including geofencing, anti-detection configurations, and real-time victim interaction through Telegram bots. This incident highlights the evolving threat landscape where cybercriminal infrastructure has become commoditized through phishing-as-a-service platforms, significantly lowering barriers to entry for less skilled attackers. The discovery comes amid increased regulatory scrutiny on cloud security and the growing sophistication of social engineering attacks targeting multi-factor authentication bypass techniques.
Kill Chain
