Global law enforcement disrupts massive phishing-as-a-service ecosystem

What happened

This operation, identified as a sprawling Chinese-language marketplace, provided tools and services for extensive phishing (messages that impersonate someone to obtain passwords or money) campaigns. Operators used AI tools to create fake organizations and acquired expired domains to appear legitimate, hosting malicious content on compromised SharePoint (Stack Exchange site for SharePoint enthusiasts) and OneDrive storage.

A significant cybercriminal operation, responsible for over a billion malicious messages and targeting more than 75,000 organizations globally, has been dismantled by international law enforcement agencies and partners. The investigation, initiated by Microsoft and Japan's National Police Agency, uncovered the YAM Store (Storm-3119) marketplace, which sold compromised Microsoft and Google environments, accounts, and licenses.

Phishing kits like CoGUI and Iron Man System (Storm-2990) offered various lures, including fake invoices and account verification requests, with features to evade security analysis. The Iron Man kit, in particular, offered over 2,300 templates impersonating banks, retailers, and government agencies. These platforms delivered more than 750 million messages, many using device-code phishing to steal authentication tokens.