Microsoft, Health-ISAC, Japanese authorities, and more disrupt a Chinese-language phishing kit ecosystem used to send 1B+ messages to 75K+ organizations in 2026

Phishing kits that once cost thousands now become available for less than $100, broadening access to sophisticated cybercrime tools.

Microsoft, in conjunction with Japanese authorities and the Health Information Sharing and Analysis Center (Health-ISAC), along with several cybersecurity firms, has dismantled a large Chinese-language phishing kit operation. This network, tracked by Microsoft as Storm-2990, provided customized tools and services used to send over one billion malicious messages to more than 75,000 organizations globally since the beginning of 2026. The phishing kits, including those known as YAM Store, CoGUI, and Iron Man, were utilized to impersonate legitimate brands and target sectors such as healthcare, finance, and logistics, predominantly in the US and Japan. Microsoft, with a federal court order, seized domains, disabled over 20,000 accounts, and continues to remove associated infrastructure, significantly disrupting the cybercriminals' capabilities to steal credentials and financial data.

The disruption of the YAM Store, CoGUI, and Iron Man ecosystem by Microsoft and its partners significantly raises the barrier to entry for cybercriminals looking to conduct large-scale phishing campaigns. By taking down these interconnected services and infrastructure, the operation makes it harder for threat actors to acquire the necessary tools and accounts, potentially leading to a decrease in the volume of sophisticated, targeted phishing attacks. This coordinated effort highlights a growing trend of public-private partnerships effectively combating transnational cybercrime by addressing the underlying supply chain of malicious tools and services.

This takedown has direct implications for organizations that have been primary targets, such as those in healthcare and financial services, potentially offering a reprieve from the relentless barrage of sophisticated phishing attempts. The reduced availability of these kits could force cybercriminals to develop their own tools or rely on less sophisticated methods, which may be easier to detect. Organizations should remain vigilant, as the disruption may spur innovation among threat actors seeking new avenues to exploit, underscoring the need for continuous adaptation in cybersecurity defenses.