Microsoft says a Chinese-language criminal ecosystem has pushed more than one billion phishing emails and text messages at over 75,000 organizations worldwide since January 2026, powered by three phishing kits and a marketplace that resells hijacked Microsoft and Google cloud accounts. Microsoft Threat Intelligence and its Digital Crimes Unit (DCU) published the research alongside word that the DCU, working with law enforcement agencies and other partners, facilitated a disruption of the ecosystem's primary developers and infrastructure.
The kits are CoGUI (also known as NX or FA), Haozi (also known as Phoenix) and Iron Man System. Microsoft tracks the developers behind all three as Storm-2990, and the marketplace that sells them, YAM Store, as Storm-3119. Microsoft identified the kits alongside industry partner Resecurity, and assesses with high confidence that Chinese-speaking actors built them. Organizations hit by downstream attacks sit mainly in healthcare, financial services, wholesale distribution and IT, in Japan, the United States, Australia and India.
A shop that sells hijacked cloud tenants
YAM Store works as an initial access broker, a middleman that sells entry into other people's systems. Microsoft describes a five-stage pipeline. Storm-3119 runs automated, Tor-routed reconnaissance to find Microsoft 365 tenants and licensing opportunities, then takes over environments using stolen application credentials. Its admin panels use an application-only sign-in flow to control the directory: silently resetting passwords, assigning education licenses and granting privileged attributes. Because that access is tied to an application rather than one user session, Microsoft says it is more durable, more scalable and harder to detect.
With a compromised Global Administrator account, the actor provisions the PnP Management Shell service principal, grants itself broad Microsoft Graph and SharePoint permissions, and turns the victim's SharePoint and OneDrive into bulk hosting it can resell. A custom DNS platform manages phishing domains and certificates through Cloudflare, and an automated storefront takes Alipay, WeChat Pay and USDT, complete with a sub-reseller tier. Storm-3119 also invents organizations outright: Microsoft cites a fake nonprofit called "Jewish Choice", tied to jewishchoice[.]org, which it assesses was likely set up with AI-generated content to get a tenant approved.
2,335 templates for 139 countries
Iron Man System alone carries over 2,335 phishing templates tailored to more than 139 countries, with the United States accounting for the most. Lures impersonate traffic and parking authorities, law enforcement, healthcare, banks, shippers and retailers, and most US lures are transportation or government themed. The kits can geofence pages to chosen countries, put fake CAPTCHA gates in front of security scanners, and use IP allow and block lists. Captured data streams back over a WebSocket, and Telegram bots alert operators the moment a victim types a password, card number or verification code, so they can steer each victim's screen live. Buyers then used the kits for credential theft, device code phishing and card fraud. Microsoft's DCU went after a separate device code phishing kit last month.
The kits were advertised through YAM Store, with Iron Man System added in June 2026, and the sellers took payment in cryptocurrency including USDT and Ethereum. Microsoft stresses that the ecosystem is not limited to abuse of its own services and extends to other providers.
Lock down Global Admins and move to passkeys
Because Storm-3119 has been seen obtaining Global Administrator access, Microsoft urges least privilege and Zero Trust controls on privileged roles, passkeys and phishing-resistant MFA enforced through Conditional Access, and MFA and passkey registration allowed only from trusted locations and devices. It also recommends applying Defender for Office 365 Safe Links to internal recipients, enabling network protection, and teaching staff to check urgent requests, such as an unpaid toll or traffic fine, by contacting the organization directly instead of following the link.
The bigger lesson is economic. Microsoft's own point is that ready-made infrastructure lowers the barrier to entry: a buyer no longer needs skill to run a convincing campaign from a legitimate-looking cloud tenant, only a Telegram contact and some cryptocurrency. That is why hitting the supply side matters more than chasing any single campaign.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.