Executive Summary
Microsoft has identified a sophisticated Chinese-language cybercriminal ecosystem led by Storm-3119, operating the 'YAM Store' marketplace. This group acts as an initial access broker (IAB), hijacking Microsoft 365 and Azure for Education tenants to resell stolen accounts, licenses, and storage. These resources power a downstream network of Phishing-as-a-Service (PaaS) providers tracked as Storm-2990, who manage kits such as Iron Man System, CoGUI, and Haozi.
The technical operation involves a five-stage pipeline: automated reconnaissance using Flask, environment takeover via app-only admin panels, resource abuse of SharePoint/OneDrive for hosting, and the deployment of advanced phishing kits. These kits feature sophisticated evasion techniques, including geofencing, fake CAPTCHA gates, and real-time credential exfiltration via Telegram bots.
This ecosystem has facilitated the distribution of over one billion phishing messages targeting the healthcare, financial, and IT sectors. The availability of high-quality, fraudulently obtained infrastructure significantly lowers the barrier for entry for global cybercriminals, leading to widespread credential theft and financial fraud across the United States, Japan, Australia, and India.