Executive Summary
In October 2026, Microsoft led a coalition including Health-ISAC, Japan Cybercrime Control Center, and private sector partners to disrupt three major phishing-as-a-service (PhaaS) kits: CoGUI, Haozi, and Iron Man System. These Chinese-language cybercriminal operations, tracked as Storm-3119 and Storm-2990, facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations across 150+ countries since January 2026. The threat actors leveraged compromised Microsoft and Google cloud environments purchased through the YAM Store marketplace, generating tens of millions in revenue while targeting healthcare, financial, and government sectors globally.
This disruption highlights the evolving sophistication of phishing-as-a-service ecosystems that abuse legitimate cloud infrastructure at scale. As organizations increasingly adopt cloud-first strategies, attackers are weaponizing trusted platforms to bypass traditional security controls, making this incident particularly relevant for understanding modern credential theft and initial access broker tactics.
Why This Matters Now
Phishing-as-a-service platforms are rapidly commoditizing sophisticated attack capabilities, enabling threat actors to launch billion-scale campaigns using legitimate cloud infrastructure, making traditional perimeter defenses insufficient against these evolving threats.
Attack Path Analysis
Storm-3119/YAM Store operators used automation to identify expired Microsoft 365 tenants via Tor infrastructure, then compromised these environments to establish administrative control panels. After gaining tenant access, they escalated privileges by granting themselves broad Microsoft Graph permissions and full SharePoint API control. The attackers moved laterally by abusing SharePoint and OneDrive for bulk hosting operations and establishing dedicated infrastructure to support phishing operations. Command and control was maintained through PHP/Java administrative panels and Telegram-based alerting systems with real-time WebSocket monitoring. Exfiltration occurred through large-scale credential harvesting operations targeting over 75,000 organizations across 150+ countries using three phishing kits. The impact resulted in over one billion phishing messages sent, facilitating downstream financial fraud and generating tens of millions of dollars for operators.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers used automated reconnaissance through Tor infrastructure to identify expired Microsoft 365 tenants and compromised cloud environments, then gained initial access to viable environments
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Phishing: Spearphishing Link
Valid Accounts: Cloud Accounts
Compromise Accounts: Cloud Accounts
Acquire Infrastructure: Web Services
Impair Defenses: Disable Cloud Logs
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Gather Victim Network Information: IP Addresses
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong User Authentication
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Risk-Based Authentication
Control ID: Identity Pillar 3
NIS2 Directive – Cybersecurity Measures
Control ID: Article 21
GDPR – Security of Processing
Control ID: Article 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Phishing-as-a-Service campaigns specifically targeted financial institutions with over 2,335 templates impersonating banking brands, requiring enhanced egress security and zero trust segmentation.
Health Care / Life Sciences
Healthcare organizations faced targeted phishing attacks across 150+ countries, necessitating encrypted traffic protection and threat detection capabilities to maintain HIPAA compliance requirements.
Information Technology/IT
IT sector vulnerable to compromised Microsoft/Google cloud environments and phishing kits exploiting legitimate infrastructure, demanding multicloud visibility and Kubernetes security controls.
Government Administration
Government entities impersonated in phishing templates across 139 countries, requiring enhanced anomaly detection and policy enforcement to protect citizen data and administrative systems.
Sources
- Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messageshttps://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.htmlVerified
- Microsoft Disrupts Major Chinese-Language Phishing Kit Ecosystemhttps://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/Verified
- Health-ISAC Disrupting Service Economy Behind Transnational Cybercrime Operationshttps://health-isac.org/disrupting-the-service-economy-behind-transnational-cybercrime-operations/Verified
- TRM Labs Analysis of Iron Man System Phishing Kit Takedownhttps://www.trmlabs.com/resources/blog/trm-supports-takedown-of-chinese-language-cybercrime-ecosystem-with-microsoft-health-isac-and-othersVerified
- Resecurity Deep Dive on Iron Man YAM Store Phishing Ecosystemhttps://www.resecurity.com/blog/article/iron-man-yamstore-powering-a-global-phishing-as-a-service-ecosystemVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have constrained Storm-3119's lateral movement across compromised Microsoft 365 tenants and limited their ability to establish widespread administrative control panels through network segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Cloud-native security fabric would likely have reduced the attackers' ability to freely establish persistent administrative control panels across multiple compromised tenant environments through workload isolation policies.
Control: Zero Trust Segmentation
Mitigation: Zero trust segmentation policies would likely have limited the attackers' ability to grant themselves broad API permissions across tenant boundaries and constrained their administrative scope within isolated network segments.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have constrained the attackers' ability to move freely between SharePoint and OneDrive instances and limited their capacity to establish coordinated hosting infrastructure across multiple environments.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely have detected and limited the attackers' ability to maintain persistent command channels across diverse infrastructure platforms including Cloudflare Workers and Telegram-based communication systems.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely have constrained the attackers' ability to exfiltrate harvested credentials at scale and limited the volume of data transmission from compromised environments to external phishing infrastructure.
While phishing message distribution would likely have continued at reduced scale, the overall financial impact to targeted organizations would likely have been constrained due to limited credential harvesting capabilities and reduced infrastructure reach.
Impact at a Glance
Affected Business Functions
- Financial Services Operations
- Healthcare Information Systems
- Customer Authentication Services
- Corporate Email and Collaboration
Estimated downtime: 3 days
Estimated loss: $50,000,000
Credentials and financial data from over 75,000 organizations across 150+ countries, including healthcare institutions, financial services firms, and government entities. Over 1 billion phishing messages sent targeting authentication credentials, payment information, and personal identifiable information.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Firewall (ACF) with URL filtering to block phishing domains and implement egress controls preventing unauthorized outbound connections to malicious infrastructure
- • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement between SharePoint/OneDrive instances and limit administrative access to cloud tenants
- • Enable Multicloud Visibility & Control to detect anomalous interactions and suspicious automation patterns indicative of phishing kit operations across hybrid environments
- • Deploy Egress Security & Policy Enforcement to prevent data exfiltration and block unauthorized destinations commonly used by phishing-as-a-service platforms
- • Activate Threat Detection & Anomaly Response capabilities to identify covert tools and establish baseline behaviors that can detect real-time credential harvesting operations
