By Anamarija Pogorelec
Publication Date: 2026-10-15 10:10:00
Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India.
Phishing kits and cloud accounts for sale
Working with Resecurity, Microsoft identified three phishing kits sold through YAM Store, an underground marketplace that the company calls Storm-3119. Microsoft groups the developers behind CoGUI (also known as NX or FA), Haozi (also known as Phoenix) and Iron Man System under one name, Storm-2990.
The developers and operators behind these kits have helped facilitate the sending of more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
The kits provide templates that impersonate brands and organizations, allowing buyers to run phishing campaigns and steal credentials.
Sample of landing pages…
