When Microsoft describes a phishing operation as an ecosystem, it is worth paying attention. On October 14, 2026, the company’s Digital Crimes Unit announced the disruption of YAM Store, an underground marketplace it tracks as Storm-3119, together with the three phishing kits sold through it: CoGUI, Haozi and the Iron Man System, tracked collectively with their developers as Storm-2990. Since January 2026, Microsoft attributes more than one billion phishing emails and text messages to actors using these tools, targeting more than 75,000 organizations across over 150 countries. More than 750 million of those messages were aimed at Microsoft customers alone.
The disruption was carried out under an order from the United States District Court for the Southern District of Florida. Microsoft seized and redirected the domains supporting the operation, deactivated more than 20,000 accounts tied to YAM Store, and blocked more than 100,000 domains used for impersonation and fraud. The investigation began after Japan’s National Police Agency alerted Microsoft to a wave of fraud in late 2025, and it grew to include Japan’s JC3 cybercrime center, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and the US Secret Service. No arrests have been announced so far.
A marketplace for stolen legitimacy
What makes YAM Store stand out from an ordinary phishing kit vendor is what it sold. Microsoft describes it as an initial access broker that hijacked Microsoft 365 and Azure for Education tenants and resold the stolen accounts, licenses and storage as a service. Its operators used automation to find expired cloud environments and dormant organization identities, acquired expired domains of real organizations, rebuilt their websites so defunct entities appeared active, and even used AI tools to fabricate convincing new organizations with content and documentation.
Inside the compromised tenants, the operators used stolen application credentials for durable, application-level access, reset passwords silently, assigned education licenses, and converted the hijacked tenants’ SharePoint and OneDrive storage into bulk hosting for phishing content. Customers paid in cryptocurrency, including USDT and Ethereum, through Telegram sales channels.
The downstream kits were industrial. The Iron Man System offered more than 2,300 templates impersonating banks, retailers, delivery services, healthcare providers and government agencies across roughly 140 countries, and displaced the older CoGUI kit by mid-2026. Resecurity’s analysis of exposed infrastructure found a publicly accessible registry with 911 published builds and a payment-card capture subsystem cataloging 2,360 phishing packages covering 130 countries, with updates through October 1, 2026. The kits supported geofencing, IP filtering, fake CAPTCHA pages that frustrate security scanners, Telegram alerts when a victim entered credentials, and live sessions that let an operator interact with a victim in real time. Many campaigns also used device-code phishing, tricking users into entering a short code that hands over authentication tokens.
Why this matters for DMARC, in both directions
Here is the part that should unsettle every email administrator. The mail sent from these hijacked tenants was, from the point of view of an inbox provider, authentic. A real Microsoft 365 tenant with a history, real DNS, working SPF, DKIM and DMARC, sends a message that passes every authentication check the industry depends on. DMARC answers the question of whether the message truly comes from the domain in the From line, and in this case it did. The domain belonged to a hijacked tenant that a criminal had rented by the hour. Microsoft itself notes that these education and nonprofit environments carried high sender reputation precisely because they looked legitimate.
That is not a failure of DMARC. It is a boundary of the question DMARC asks. Authentication proves domain control, not sender honesty, and criminals have now industrialized the acquisition of domains that pass authentication for free. Phishing-resistant sign-in such as passkeys, conditional access policies, and monitoring for tenant takeover remain the defenses for that half of the problem.
But there is a second, sharper lesson, and it points straight at your DNS. YAM Store’s supply chain started with expired domains and dormant organization identities that nobody was watching. Every organization has parked domains, legacy education or nonprofit tenants, and defunct brands that still resolve. If a criminal reactivates one of them, your own name becomes the authenticated infrastructure in someone else’s phishing campaign. Enforcing DMARC with p=reject on every domain you own, including the ones you never send mail from, closes that door. And reading your aggregate reports is how you notice a sender that should not exist, before a takedown press release names you as the compromised party.
What to do this week
First, inventory your domains and cloud tenants, including the inactive ones, and put enforcement policies on all of them. Second, enable phishing-resistant multifactor authentication and monitor for silent password resets and unexpected service principals in your tenant. Third, treat device-code sign-in prompts as hostile by default, because this ecosystem used them to steal tokens. And fourth, keep watching the reports, because Microsoft’s Steven Masada put it plainly: delete and block one of these services, and another takes its place.
Authentication cannot tell you whether a sender deserves trust, but it guarantees that nobody can send as you without you knowing. Excello Mail turns your DMARC, SPF and DKIM reports into a clear, continuous picture of every service sending as your domains, active or dormant, so you can enforce your policy before someone else exploits your name. Sign up for free to Excello Mail and make sure your domains never end up in the wrong hands.