Microsoft uncovered a large Chinese-language phishing ecosystem involving interconnected phishing kit developers, an illicit marketplace called YAM Store, and numerous threat actors leveraging compromised or fraudulent Microsoft and Google cloud environments to launch large-scale phishing and credential theft campaigns worldwide. YAM Store acts as an access broker selling hijacked Microsoft 365 and Azure tenants and related infrastructure, which phishing kit operators such as Iron Man System use to provide phishing-as-a-service tools enabling real-time credential harvesting and financial fraud across multiple sectors and countries. Microsoft disrupted the ecosystem’s core infrastructure and recommends user education and vigilance to mitigate these widespread social engineering and account takeover risks.
The Hidden Network: Inside the Phishing Infrastructure Ecosystem Powering Global Cybercrime
