Microsoft, in collaboration with industry and law enforcement partners, has taken significant steps to dismantle a major phishing network that has targeted tens of thousands of organizations globally since January. According to a report released on October 14, Microsoft's efforts alongside the Japanese police have exposed a complex phishing-as-a-service ecosystem, known as Yam Store, operated by Chinese-language cybercriminals. This network has been responsible for distributing over a billion phishing emails and text messages to more than 75,000 organizations.

Yam Store functions as an underground marketplace, tracked by Microsoft under the name Storm-3119, selling compromised Microsoft and Google domains. It also offers phishing kits like CoGUI, Haozi, and Iron Man System, collectively tracked as Storm-2990. These tools are used to impersonate legitimate organizations across various industries, including healthcare, financial services, and IT, to steal sensitive information such as login credentials and financial data.

The operators behind Yam Store cleverly exploited expired internet domains to create seemingly active websites, allowing them to fraudulently acquire Microsoft 365 accounts. These accounts are then resold through an automated storefront, facilitating further phishing activities. Additionally, fake organizations were created with AI-generated content and forged documents to establish Microsoft tenants, further expanding the network's reach.

The lures used by Yam Store focus on common themes like unpaid tolls, parcel delivery issues, and impersonation of banks and government entities to deceive victims into providing their credentials. Microsoft's continued efforts have led to the disabling of over 20,000 accounts linked to Yam Store and the removal of infrastructure hosted on its services. The company is also actively blocking more than 100,000 domains used for impersonation and fraud, undermining the network's ability to operate.