How a billion phishing messages were mass-produced by one kit network

Phishing emails that look like they come from a bank or a delivery company are not written one at a time anymore. According to Microsoft, a Chinese-language criminal network built phishing kits as off-the-shelf products, sold them through an underground marketplace, and let any buyer run large-scale credential theft campaigns without writing a line of code.

The marketplace is called YAM Store, tracked by Microsoft as Storm-3119. It sold three separate phishing kits: CoGUI, Haozi, and Iron Man System. Microsoft tracks the developers behind all three as Storm-2990. The kits looked like competing products, with their own branding and their own sales channels on Telegram, but they shared infrastructure and overlapping activity, which points to shared code or close cooperation between the people who built them.

What the kit actually does

A phishing kit is a ready-made template that impersonates a real organization: a government agency, a bank, a logistics company. The buyer does not design the fake page or write the email. The kit provides it. What the buyer adds is volume and targets. Since January 2026, the threat actors using these kits have sent more than one billion phishing emails and SMS messages to over 75 thousand organizations worldwide, hitting healthcare, financial services, wholesale distribution, and IT sectors in Japan, the United States, Australia, and India.

The kits also came bundled with access to compromised or fraudulent Microsoft or Google cloud environments and the credentials tied to them. That matters because it means the people running these campaigns did not need to breach anything themselves. The infrastructure dealer had already done it, and sold entry as a separate product alongside the phishing templates.

Where the scam actually depends on scale

This is the part the source makes clear without saying it outright: the scam does not depend on any single message being convincing. It depends on the economics of selling the tooling separately from the targeting. One developer builds the template once. One dealer sells cloud access once. Thousands of buyers then run their own campaigns against different victims, in different countries, in different sectors, using the same underlying kit. A message that fails against one recipient costs the buyer almost nothing, because the template, the infrastructure, and the credential access were all purchased, not built.

That is why a single disruption, the one Microsoft carried out with law enforcement partners worldwide, can touch so many countries at once. Taking down the developers and the shared infrastructure behind CoGUI, Haozi, and Iron Man System does not just stop one phishing campaign. It removes the supply line that many separate campaigns were drawing from.

The tell for a reader

None of this changes what a phishing email or text actually looks like on the screen. It still impersonates a brand, a bank, a government body, or a delivery service, and it still asks for a login or a click. Because these kits are templated and reused across thousands of targets, the same impersonation patterns turn up again and again across unrelated organizations. Treating any unexpected message asking for a login as suspect, regardless of how polished it looks, is still the step that stops the chain, because the kit's polish was never the part that varied.