Microsoft & Health-ISAC Disrupt Chinese PhaaS Marketplace
Microsoft & Partners Disrupt Major Phishing-as-a-Service Operation
Related Entities
Threat Actors
Organizations
Other
Full Report
Executive Summary
On October 15, 2026, Microsoft, the Health Information Sharing and Analysis Center (Health-ISAC), and Japan's National Police Agency announced a major disruption against a prolific Chinese-language Phishing-as-a-Service (PhaaS) ecosystem. The coordinated operation seized and redirected domains belonging to three criminal enterprises: YAM Store (tracked by Microsoft as Storm-3119), CoGUI, and Iron Man (whose kit is tracked as Storm-2990). These services provided the tools and infrastructure for threat actors to launch widespread phishing campaigns, which targeted over 75,000 organizations in more than 150 countries and generated tens of millions of dollars for the operators.
Threat Overview
The disrupted marketplace was a one-stop shop for cybercriminals, significantly lowering the barrier to entry for conducting large-scale phishing attacks. The services offered included:
- Phishing Kits: The CoGUI and Iron Man System kits provided thousands of phishing templates mimicking legitimate login pages for popular services.
- Infrastructure: The YAM Store served as a central marketplace, selling compromised Microsoft and Google environments for hosting malicious content.
- Advanced Techniques: The operators employed sophisticated methods, including using AI to create fake organizations and abusing legitimate services like SharePoint and OneDrive to evade detection. They also utilized device-code phishing techniques to steal authentication tokens, which can bypass some forms of MFA.
This PhaaS model enabled a global network of criminals to attack a wide range of industries, with a significant focus on healthcare and financial services.
Technical Analysis
The operation's success hinged on a coordinated legal and technical effort to seize the domains used by the criminal infrastructure. The threat actors demonstrated a high level of sophistication:
- T1656 - Acquire Infrastructure: The YAM Store operators acquired and sold compromised cloud environments, providing ready-to-use infrastructure for phishing campaigns.
- T1566.002 - Spearphishing Link: The core service was enabling the creation and distribution of malicious links designed to steal credentials.
- T1539 - Steal Web Session Cookie: The use of device-code phishing is a modern technique to steal authentication tokens and session cookies, bypassing MFA prompts by tricking the user into authorizing a session on the attacker's device.
- T1587.001 - Malicious Domain: The operators registered and managed a vast network of domains to host their phishing kits and landing pages.
Microsoft's threat intelligence designated the YAM Store operators as Storm-3119 and the Iron Man kit developers/operators as Storm-2990.
Impact Assessment
This takedown represents a significant disruption to the cybercrime supply chain. By removing the infrastructure for YAM Store, CoGUI, and Iron Man, the operation has:
- Increased Costs for Attackers: Criminals who relied on these cheap, effective services must now find new providers or develop their own tools, increasing their operational costs and complexity.
- Prevented Future Attacks: The seizure of the domains prevents the distribution of over one billion malicious messages that the services were projected to send.
- Protected Potential Victims: Over 75,000 organizations, particularly in vulnerable sectors like healthcare, are now safer from attacks originating from this ecosystem.
- Gathered Intelligence: The operation likely provided law enforcement and security researchers with valuable intelligence on the operators and their customers, which could lead to future arrests and disruptions.
IOCs — Directly from Articles
No specific domains, IPs, or hashes were provided in the source articles.
Detection & Response
While the primary infrastructure has been disrupted, defenders should remain vigilant for similar PhaaS-enabled attacks.
- Detect Device-Code Phishing: Monitor Azure AD sign-in logs for an increase in
device_codegrant types. Legitimate use is rare for most users. Correlate these events with user-reported phishing attempts. This can be supported by D3-UBA: User Behavior Analysis. - Analyze Email Content: Use email security gateways to scan for links pointing to newly registered domains or using URL shorteners. Analyze for language and templates commonly used in credential phishing.
- Monitor Cloud Sharing: Implement alerts for anomalous external sharing of files from SharePoint and OneDrive, as these services were abused by the threat actors to host malicious content. This aligns with D3-UDTA: User Data Transfer Analysis.
Mitigation
Strengthening defenses against phishing is the most effective long-term strategy.
- Phishing-Resistant MFA: Move towards phishing-resistant MFA methods like FIDO2 security keys or certificate-based authentication. These methods are not susceptible to token theft via device-code phishing. This is the most advanced form of D3-MFA: Multi-factor Authentication.
- User Training: Continuously train users to recognize the signs of phishing, especially modern techniques like MFA-bypass and consent grant attacks. Training should include simulations of device-code phishing flows.
- Restrict Web Content: Employ web filtering solutions to block access to known malicious domains and newly registered domains that are often used in phishing campaigns.
- Email Gateway Configuration: Ensure your email security gateway is configured to perform robust link analysis, sandboxing of attachments, and sender reputation checks.
Timeline of Events
MITRE ATT&CK Mitigations
User Training
Training users to identify sophisticated phishing attacks, including MFA bypass techniques, is a critical layer of defense.
Multi-factor Authentication
Implementing phishing-resistant MFA (like FIDO2) is the most effective technical control against credential theft and token stealing.
Restrict Web-Based Content
Using web filters to block access to known malicious and newly registered domains can prevent users from reaching phishing pages.
D3FEND Defensive Countermeasures
To counter the device-code phishing techniques employed by these PhaaS platforms, organizations must prioritize the adoption of phishing-resistant Multi-Factor Authentication (MFA). Methods such as FIDO2/WebAuthn security keys, Windows Hello for Business, or certificate-based authentication bind the authentication process to the user's device, making it impossible for an attacker to steal and replay a token from a different location. A phased rollout should begin with privileged users (administrators, executives) and then expand to the general user population. While traditional MFA (SMS, push notifications) is better than none, this incident demonstrates that determined attackers can bypass it. Investing in phishing-resistant MFA is a strategic control that directly mitigates the primary threat of credential and token theft.
Implement User Behavior Analysis (UBA) to detect anomalies in authentication patterns. Configure your SIEM or identity protection solution to alert on suspicious sequences of events, such as a user login from an unfamiliar location or IP immediately following a device-code authorization flow. Establish baselines for normal user activity and flag deviations. For example, an alert should be generated if a user who has never used the device-code grant type suddenly initiates such a request. This behavioral detection layer can catch successful phishing attempts even when the malicious link or page was not blocked, providing a critical opportunity for rapid response.
Leverage DNS filtering services that incorporate threat intelligence feeds to block access to known phishing domains and infrastructure. These services should be configured to also block access to newly registered domains (NRDs), as PhaaS operators constantly cycle through new domains for their campaigns. By preventing the initial DNS resolution of the malicious URL, the user's browser never even attempts to connect to the phishing server. This is a highly effective, low-overhead control that can be deployed across the entire organization. Ensure this protection is active on all endpoints, including remote and mobile devices, not just within the corporate network perimeter.
Timeline of Events
Microsoft and partners announce the successful disruption of the PhaaS marketplace.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.