YAM Store sells Microsoft and Google cloud access to phishing crews

Microsoft attributes more than one billion phishing emails and SMS messages sent since January 2026 to three linked kits targeting more than 75,000 organizations. Its October 14 investigation traces their supply chain to YAM Store, which sells access to compromised or fraudulently obtained Microsoft and Google cloud environments. The measured volume covers messages and targeted organizations.

In Microsoft 365 and Azure for Education tenants, the broker can use a stolen application client secret for app-only directory control. Microsoft describes silent password resets, education-license assignments, provisioning of PnP Management Shell, privileged Graph permissions including AppCatalog.ReadWrite.All, and bulk hosting in SharePoint and OneDrive. Compare privileged app credentials and service principals with your approved inventory, then correlate directory changes with unusual cloud storage. Revoke unauthorized grants, rotate compromised application secrets and quarantine abusive storage through your response process. Check the post-response inventory and activity window for fresh changes.

Apply Safe Links to internal email recipients and test an internal message with a harmless URL. Microsoft warns that unwrapped links rely on supported Outlook clients for click-time checks; account for other mail clients in your protection assessment. After the broker disruption, verify that app credentials in your tenant are under your control.