Microsoft uncovers marketplace for phishing
A Chinese-language network sold accounts, infrastructure and ready-made fake sites to cybercriminals worldwide.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Microsoft says it has uncovered and disrupted a commercial infrastructure behind large-scale phishing campaigns. According to the company, criminals could buy stolen cloud environments, phishing kits and cloned websites, among other things, through the YAM Store marketplace.
Microsoft’s researchers describe YAM Store as a kind of intermediary for cybercriminals. According to them, the service sold fraudulently obtained or taken-over Microsoft and Google environments, accounts, licences and storage. That infrastructure could then be used for phishing campaigns or resold to other criminals.
Around YAM Store, Microsoft discovered three phishing kits: CoGUI, Haozi and Iron Man System. The kits contain templates for emails, text messages and websites posing as banks, government services, transport companies, online retailers or healthcare organisations. Microsoft says the kits have enabled the sending of more than one billion malicious messages to over 75,000 organisations since January.
Some of the templates focused on impersonating government bodies, with messages about traffic fines, unpaid tolls or tax matters. According to Microsoft, an organisation’s presence in such a template does not mean that its systems have been hacked. The technique instead centres on imitating a trusted name or visual identity to steal passwords, payment details or verification codes.
Microsoft and partner organisations carried out controlled purchases and mapped the infrastructure, according to the company. Following an order from a US federal court, domains associated with YAM Store, CoGUI and Iron Man were seized or redirected. Microsoft also says it disabled more than 20,000 linked accounts and blocked more than 100,000 domains used for impersonation and fraud.
According to Microsoft, the Japanese police assisted with the investigation after fraudulent campaigns targeting Japanese organisations were discovered. The independent specialist publication BleepingComputer describes the same operation and additionally names Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs as participating partners. The reports show how cybercrime is increasingly being offered as a service: not everyone running a campaign still needs to build the technical infrastructure themselves.
The Dutch Tax Administration has long warned that criminals can impersonate the service by email, text message or WhatsApp. Microsoft’s new investigation does not prove that a Dutch government website was breached. It does show why messages about taxes, deliveries, tolls or account problems can seem especially convincing: such themes have been incorporated into ready-made criminal templates in advance.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The infrastructure, figures and disruption measures described can be found in Microsoft’s investigation and are broadly confirmed by BleepingComputer. The article clearly distinguishes between impersonating organisations and actually breaking into them.
- confirmed YAM Store sold fraudulently obtained cloud environments, accounts, licences and storage. — Description from the Microsoft Security Blog. source
- confirmed Since January, the kits involved have enabled more than one billion malicious messages targeting over 75,000 organisations. — Mentioned by Microsoft and reproduced with attribution by BleepingComputer. source
- confirmed Microsoft and Health-ISAC seized or redirected domains after an order from a US court. — Described in the Microsoft publication. source
- confirmed The Dutch Tax Administration warns about phishing via email, text message and WhatsApp. — Mentioned on the Dutch Tax Administration’s official warning page. source
Editor's note
Microsoft is the primary source for the scale and the legal disruption; BleepingComputer independently confirms the main points. No evidence was found that Dutch government servers were hacked.Sources
- The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime — Microsoft Threat Intelligence
- Global takedown hits network behind 1 billion phishing messages — BleepingComputer
- Scams and fake messages — Belastingdienst