Phishing Infrastructure Ecosystem Exposed by Microsoft

Introduction

Microsoft has uncovered a large phishing infrastructure ecosystem that shows how cybercrime has become increasingly commercialized. For IT and security teams, this research is important because the actors did not just send phishing messages—they also abused Microsoft 365, Azure, SharePoint, and cloud application permissions to build scalable attack infrastructure.

What Microsoft found

Microsoft Threat Intelligence and the Digital Crimes Unit identified an interconnected ecosystem centered on YAM Store (tracked as Storm-3119) and phishing kit operators tracked as Storm-2990.

Key findings include:

• Microsoft linked CoGUI, Haozi, and Iron Man System phishing kits to a broader Chinese-language cybercriminal network.
• Since January 2026, the ecosystem has reportedly enabled the delivery of more than 1 billion phishing emails and SMS messages targeting over 75,000 organizations worldwide.
• Impacted sectors included healthcare, financial services, wholesale distribution, and IT across countries such as Japan, the United States, Australia, and India.
• YAM Store allegedly sold access to compromised or fraudulently obtained Microsoft and Google cloud environments, helping threat actors appear more legitimate.

How the infrastructure worked

Microsoft described a five-stage pipeline used by YAM Store and related actors:

• Reconnaissance: Automated discovery of Microsoft 365 and Azure-enabled organizations.
• Environment takeover: Use of stolen application credentials and app-only access for persistent control.
• Resource abuse: Compromised tenants were used to provision storage and abuse SharePoint and OneDrive for hosting.
• Phishing infrastructure support: Centralized DNS, SSL, and routing management through dedicated tooling.
• Monetization: Resale of hijacked accounts, licenses, and storage to downstream phishing operators.

A notable concern is the use of application-level access and service principals, which can be harder to detect than traditional user-based compromise.

Why this matters for administrators

For Microsoft 365 and Azure administrators, this research reinforces that phishing defense is no longer only about email filtering. Attackers are also targeting:

• Entra ID app registrations and secrets
• Privileged roles and Global Administrator accounts
• SharePoint and OneDrive storage abuse
• Microsoft Graph permissions and service principals

This means defenders need better visibility into non-user identities, consented apps, and suspicious tenant configuration changes.

Recommended next steps

Security teams should review Microsoft’s mitigation and protection guidance and consider these actions:

• Audit enterprise applications, app registrations, and client secrets
• Monitor for unusual service principal creation and elevated Graph permissions
• Review Global Administrator activity and enforce least privilege
• Inspect SharePoint and OneDrive for suspicious hosting or bulk file activity
• Strengthen phishing-resistant MFA and user awareness training
• Use Microsoft Defender detections and hunting content to investigate related activity

Microsoft’s disruption of this ecosystem is significant, but the report is also a reminder that cloud identity and app governance must be core parts of every phishing defense strategy.