Since January 2026, three linked phishing kits have facilitated more than one billion phishing emails and SMS messages to more than 75,000 organizations, according to Microsoft’s October 14 investigation. Behind the messages, a broker called YAM Store sells access to compromised or fraudulently obtained Microsoft and Google cloud environments. The danger for a tenant administrator is twofold: an intruder can keep application-level directory access and turn the organization’s cloud storage into infrastructure for someone else’s phishing campaign.
Microsoft calls the broker Storm-3119 and the developers of CoGUI, Haozi and Iron Man System Storm-2990. Microsoft says its Digital Crimes Unit, law enforcement and partners disrupted the ecosystem’s primary developers and infrastructure; administrators still need to inspect their own tenants for unauthorized access and hosted content.
Cloud tenants become inventory
YAM Store sells accounts, licenses and storage drawn from compromised Microsoft 365 and Azure for Education tenants. Microsoft also describes separately created fraudulent organizations used to establish new tenants. The broker advertises environments by age, subscription and institution type, including education and nonprofit organizations. One fabricated nonprofit identity, “Jewish Choice,” used jewishchoice[.]org as its web presence, according to Microsoft’s assessment. Treat the domain as a case example; investigate tenant and app activity rather than building a blocklist around one fabricated identity.
Storm-3119 first profiles tenant enrollment and licensing opportunities. After obtaining an application’s client secret, an actor-operated panel uses app-only authentication to control the directory: it resets passwords without a next-sign-in change prompt, assigns education licenses and grants privileged attributes. Microsoft writes, “Because this access is application-level rather than tied to a single user session, the resulting persistence is more durable, more scalable, and harder to detect.” An app credential can outlive a user session and keep directory access open.
With a compromised Global Administrator account, the actor provisions the PnP Management Shell service principal and grants broad Microsoft Graph permissions, including AppCatalog.ReadWrite.All, alongside SharePoint API control. SharePoint and OneDrive become bulk hosting sold through the storefront. Storm-3119 also manages phishing domains, certificates and routing through Cloudflare; downstream customers buy the tenant resources and kits. Microsoft assesses that the activity spans providers beyond its own services. Microsoft operates the cloud platform involved and sells the Defender products recommended here; the scale and actor names are its own findings.
A rented kit runs the lure
Iron Man System alone contains more than 2,335 templates for more than 139 countries, Microsoft reports. The templates impersonate transportation agencies, healthcare providers, retailers and financial services. The kit can restrict visitors by geography or IP address and put a fake CAPTCHA in front of a phishing page. Those filters can hide a live lure from a researcher testing it from another country or network.
When a target enters credentials, card data or verification codes, the kit collects them over a WebSocket and can notify its operator through Telegram. Microsoft observed downstream actors using Storm-2990-affiliated infrastructure for credential theft, device-code phishing in some cases, and financial fraud. A driver who sees a parking-fee message and an administrator who sees an unfamiliar app credential may be looking at different ends of the same commercial supply chain. Use tenant application and storage evidence before attributing a branded lure to this broker.
Find the tenant-side sequence
Start with Microsoft 365 and Azure for Education tenants where cloud applications hold privileged credentials. Compare the current Entra application and service-principal inventory against your approved list. Examine application-only access, unexpected credential material, newly privileged grants and the presence and permissions of PnP Management Shell. In directory change records, look for password resets without a required next-sign-in change, education-license assignments and privileged attribute changes near those app events. Then examine SharePoint and OneDrive for unfamiliar bulk hosting or externally accessible files. This is a correlation task: an app permission by itself is a review lead; the linked directory and storage actions are the sharper incident signal.
For a tenant matching that sequence, contain the unauthorized application access, revoke the unapproved grants and rotate compromised application secrets. Remove or quarantine abusive SharePoint and OneDrive content through your response process. Limit Global Administrator membership and apply phishing-resistant authentication to privileged accounts as Microsoft recommends. Confirm who authorized the PnP Management Shell service principal and what permissions it holds before removing it.
For the message side, configure Safe Links to cover internal-to-internal email as well as the protected recipients in your policy. Microsoft’s Safe Links documentation says the “Apply Safe Links to email messages sent within the organization” setting is recommended on. It also describes a real limit: when rewriting is disabled, click-time checking depends on supported Outlook clients; another mail client may miss a link that becomes malicious after delivery. Verify which clients your users actually use before treating policy presence as click protection.
Test access after containment
Export the post-response app inventory and permissions, then compare them with the approved baseline. Check the following directory and storage activity window for fresh silent resets, unexpected license grants and new hosted phishing material. An authorized test message between two covered internal recipients can confirm that Safe Links processes an internal URL under the configured policy; use a harmless link and account for whether your policy rewrites URLs or uses supported-client checks. The expected result is no unapproved app grant or renewed abusive storage, with the internal message receiving the configured link protection.
The broker’s storefront and a phishing page sit downstream from tenant credentials that may survive a user’s password change. Follow the app credential and its storage permissions to the source of access, then verify that the tenant stops supplying the service the broker sold.