Executive Summary
In 2026, Microsoft Threat Intelligence exposed Yam Store, a Chinese-language cybercrime marketplace tracked as Storm-3119, responsible for facilitating over one billion phishing emails and SMS messages targeting 75,000 organizations worldwide. The operation sold phishing kits including CoGUI, Haozi, and Iron Man System, along with fraudulently obtained Microsoft and Google cloud domains from legitimate organizations. Storm-3119 leveraged automation to identify expired environments and used legitimate customer information to circumvent detection systems, enabling threat actors to operate seemingly trustworthy phishing infrastructure at scale.
This incident highlights the industrialization of phishing-as-a-service operations and the increasing sophistication of cloud infrastructure abuse. As threat actors leverage AI and legitimate cloud services to enhance their campaigns, organizations face unprecedented challenges in distinguishing malicious activity from legitimate communications, making traditional security awareness training and detection methods insufficient.
Why This Matters Now
The Yam Store operation represents the evolution of phishing into a fully industrialized ecosystem leveraging legitimate cloud infrastructure and AI-generated content, making traditional email security and user training inadequate against these sophisticated, automated attacks at billion-message scale.
Attack Path Analysis
Yam Store (Storm-3119) operated a phishing-as-a-service marketplace that leveraged fraudulently obtained Microsoft and Google cloud domains to appear legitimate. The operation distributed phishing kits (CoGUI, Haozi, Iron Man System) that facilitated over 1 billion phishing messages to 75,000+ organizations, using cloud infrastructure abuse and automation to bypass security controls and harvest credentials at scale.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Storm-3119 used automation to identify expired Microsoft and Google cloud environments, then leveraged legitimate customer information to fraudulently obtain over 140,000 malicious domains across 20,000+ tenants, creating trusted-appearing phishing infrastructure
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Phishing: Spearphishing Link
Stage Capabilities: Upload Malware
Acquire Infrastructure: Web Services
Compromise Accounts: Email Accounts
Obfuscated Files or Information
Phishing for Information: Spearphishing via Service
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Incident Response Plan
Control ID: 12.10.1
NYDFS 23 NYCRR 500 – Training and Monitoring
Control ID: 500.14
DORA – Identification
Control ID: Article 8
CISA ZTMM 2.0 – Strong Identity Foundation
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21
ISO 27001 – Information Transfer Policies and Procedures
Control ID: A.13.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Highly targeted by Yam Store's billion-message phishing campaign using fraudulent cloud domains, compromising customer credentials and financial data through sophisticated evasion techniques.
Health Care / Life Sciences
Critical risk from phishing templates mimicking healthcare organizations, threatening HIPAA compliance and patient data security through compromised Microsoft/Google cloud environments.
Government Administration
Significant exposure to phishing lures impersonating government entities and law enforcement, potentially compromising sensitive citizen data and critical infrastructure operations.
Information Technology/IT
Primary attack vector through compromised cloud infrastructure abuse, requiring enhanced egress security and zero trust segmentation to prevent lateral movement attacks.
Sources
- Yam Store: The Phishing Network Behind a Billion Messageshttps://www.darkreading.com/cyberattacks-data-breaches/yam-store-phishing-network-behind-billion-messagesVerified
- Microsoft Threat Intelligence Report on Storm-3119 and Phishing Ecosystemhttps://blogs.microsoft.com/on-the-issues/Verified
- CISA Advisory on Phishing Campaign Indicatorshttps://www.cisa.gov/news-events/cybersecurity-advisoriesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would constrain Storm-3119's multi-cloud phishing infrastructure by enforcing segmented access controls across compromised cloud tenants and limiting lateral expansion through east-west traffic monitoring. The attack's blast radius would likely be reduced through controlled egress policies and workload isolation preventing unrestricted distribution of phishing kits.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The automated takeover of expired cloud environments would likely face constraints through identity-aware access controls and tenant isolation policies that limit unauthorized administrative actions across cloud workspaces
Control: Zero Trust Segmentation
Mitigation: Privilege escalation across compromised cloud tenants would likely be constrained by microsegmentation policies that limit the scope of administrative access and reduce cross-tenant privilege expansion capabilities
Control: East-West Traffic Security
Mitigation: Cross-tenant distribution of phishing infrastructure would likely be constrained by east-west traffic monitoring and inter-workload communication policies that limit unauthorized data flows between cloud services and regions
Control: Multicloud Visibility & Control
Mitigation: Cloud-hosted command and control operations would likely face constraints through multicloud monitoring that provides visibility into suspicious communication patterns and unauthorized external connections across compromised infrastructure
Control: Egress Security & Policy Enforcement
Mitigation: Large-scale data exfiltration through Telegram bots and cloud storage would likely be constrained by egress policy enforcement that monitors and restricts unauthorized outbound data flows from compromised phishing infrastructure
While credential theft from victims would likely still occur, the overall impact would be reduced through constrained attacker infrastructure scope and limited blast radius across compromised cloud environments
Impact at a Glance
Affected Business Functions
- Email Communications
- Identity and Access Management
- Customer Authentication Systems
- Financial Transaction Processing
Estimated downtime: N/A
Estimated loss: N/A
Credential theft and unauthorized access to user accounts across 75,000 organizations worldwide. Compromised data likely includes login credentials, multi-factor authentication codes, personal identification information, and potentially financial data from phishing campaigns targeting banking, government, healthcare, and retail sectors.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Cloud Native Security Fabric (CNSF) with inline enforcement and distributed policy to detect and block fraudulent cloud tenant provisioning and domain abuse
- • Deploy Egress Security & Policy Enforcement to prevent unauthorized outbound communications to Telegram bots and external data exfiltration channels used by phishing operations
- • Establish Zero Trust Segmentation with identity-based policies and microsegmentation to limit the blast radius of compromised cloud tenants and prevent lateral movement across cloud environments
- • Enable Multicloud Visibility & Control with centralized policy management to detect anomalous tenant creation, suspicious automation patterns, and repeated malformed requests indicative of phishing kit deployment
- • Implement Threat Detection & Anomaly Response capabilities to baseline normal cloud tenant behavior and alert on deviations consistent with fraudulent infrastructure acquisition and phishing-as-a-service operations
