Microsoft uncovered a large Chinese-language phishing ecosystem involving interconnected phishing kit developers, an illicit marketplace called YAM Store, and numerous threat actors leveraging compromised or fraudulent Microsoft and Google cloud environments to launch large-scale phishing and credential theft campaigns worldwide. YAM Store acts as an access broker selling hijacked Microsoft 365 and Azure tenants and related infrastructure, which phishing kit operators such as Iron Man System use to provide phishing-as-a-service tools enabling real-time credential harvesting and financial fraud across multiple sectors and countries. Microsoft disrupted the ecosystem’s core infrastructure and recommends user education and vigilance to mitigate these widespread social engineering and account takeover risks.

https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/

Law enforcement agencies and partners worldwide have dismantled a large cybercriminal network responsible for over one billion phishing messages targeting more than 75,000 organizations in 150 countries. The operation involved the YAM Store marketplace and phishing kits CoGUI, Haozi, and Iron Man, which exploited compromised Microsoft and Google accounts and employed sophisticated tactics like AI-generated fake organizations and geofencing to evade detection. Microsoft and collaborators seized domains, disabled accounts, and blocked malicious infrastructure to disrupt the campaign, which had particularly targeted Microsoft 365 customers with device-code phishing to steal authentication tokens.

https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/