YAM Store Phishing Kits: A Billion-Message Market That Hides Its Lures From Scanners
YAM Store sold cloud tenants and the CoGUI, Haozi and Iron Man System phishing kits. How geofencing and CAPTCHA gates hide the lure from scanners.
AegisAI Threat IntelligenceAegisAI Threat Watch · Phishing-as-a-service
YAM Store Phishing Kits: A Billion-Message Market That Hides Its Lures From Scanners
A phishing-as-a-service market sold the lure, the cloud tenant that hosts it and the evasion that keeps scanners out, and one court-backed takedown on 14 October hit all three.
Analysis based on Resecurity research and takedown reporting, 14 to 15 Oct 2026.
Phishing kits evade scanners by gating the page: geofencing, fake CAPTCHAs and IP lists show a security scanner nothing, while the intended victim sees the brand-themed lure.
On 14 October 2026 Microsoft and Health-ISAC announced a court-backed disruption of three Chinese-language services that sold this capability as a product: YAM Store, an underground marketplace for hijacked cloud tenants, and two phishing kits sold through it, CoGUI and Iron Man System. The reporting puts their output at more than one billion phishing emails and SMS messages since January 2026, and does not split the two channels.
Sources: SecurityWeek and BleepingComputer for the message, organization, account and domain figures; Resecurity for the lure packages.
Key judgments
- The product is the whole chain. YAM Store sold the cloud tenant that hosts the page, and the kits sold the lure and the evasion, so a buyer needed no infrastructure of their own.
- Evasion ships in the box. Geofencing, fake CAPTCHA gates and IP lists are kit features, so every buyer inherits the same ability to turn scanners away.
- A clean link verdict is weak evidence. A scanner that the kit has already filtered out reports an empty page, which says nothing about what a recipient would see.
- A takedown is supply-side. Seized domains and disabled accounts raise the cost for the operators; they do not change what reaches a mailbox next week.
What did the 14 October takedown of YAM Store, CoGUI and Iron Man System disrupt?
It disrupted a supply chain, not a single campaign. YAM Store is described as an initial access broker and marketplace, tracked as Storm-3119. CoGUI, Haozi and Iron Man System are the phishing kits advertised through it, and their developer cluster is tracked as Storm-2990 (BleepingComputer). Iron Man System was advertised from June 2026 and was displacing CoGUI by mid-2026 (SecurityWeek).
The court order and the partners
A federal judge in the Southern District of Florida granted Microsoft and Health-ISAC's request on 7 October 2026 to take control of the services' domain names (Cybersecurity Dive). Under that order the two organizations seized and redirected domains supporting the three services. Microsoft also disabled more than 20,000 YAM Store accounts and is blocking more than 100,000 domains used for impersonation and fraud (BleepingComputer).
Health-ISAC joined the civil suit because the infrastructure was used against hospitals and other healthcare organizations (SecurityWeek). Japan's Cybercrime Control Center (JC3) says it passed Microsoft information on phishing damage in Japan (JC3), and TRM Labs says its intelligence helped locate and freeze assets linked to the group (TRM Labs). Resecurity, Cloudflare and Oracle also supported the action (BleepingComputer).
What the takedown leaves in place
Resecurity bought a license for Iron Man System and ran it in an isolated lab. It found that the admin panel polls its license endpoint about every 20 seconds and cannot operate without regular contact with the vendor's authorization host. Resecurity concludes that disabling or sinkholing that host would degrade every active deployment at once (Resecurity). The reporting does not say that this has been done.
YAM Store sold the cloud accounts and hosting that the kits ran on
YAM Store sold tools and infrastructure built on compromised or fraudulently obtained Microsoft and Google environments, including accounts, licenses and storage. Buyers could filter by account age, subscription type and environment type, such as education or nonprofit (SecurityWeek). Some operators bought the expired domains of real nonprofits and schools, rebuilt their websites, and used them to obtain Microsoft 365 accounts for sale (TRM Labs). The reporting also describes operators using AI tools to generate fake organizations with content and documentation (BleepingComputer).
The pipeline, step by step
- Automated discovery of expired organization names, cloud-enabled organizations and Microsoft 365 tenants, run anonymously over Tor.
- Takeover of viable environments through app-only admin panels.
- Use of the compromised tenant's SharePoint and OneDrive storage as bulk hosting.
- Dedicated infrastructure to run phishing operations for customers.
- Resale of hijacked accounts, licenses and storage through an automated storefront, with payment in cryptocurrency including USDT and Ethereum (The Hacker News).
The effect for email defenders is that the page behind the link can sit on a real, aged, trusted tenant. A reputation check on the hosting domain returns a good answer for the wrong reason.
How do phishing kits evade traditional security filters?
They stack three defenses on the landing page, and the reporting names all three. None of them touches the email itself, which is why a clean-looking message can arrive with a link that no scanner will ever see fail.
Gates that turn scanners away
The kits support geofencing, fake CAPTCHA gates and IP filtering to obstruct security analysis (BleepingComputer). Geofencing restricts the lure to visitors from chosen countries, the CAPTCHA filters out automated browsing, and the allow and block lists decide which addresses are served at all (The Hacker News).
Operators who watch the session
Data entered on the page is captured over a WebSocket connection, and a Telegram alert tells the operator when a victim acts. The operator watches progress live and decides what the victim sees next (The Hacker News). The kits act as live, interactive credential-harvesting platforms, and operators can prompt victims for one-time verification codes (SecurityWeek). Many of the messages aimed at Microsoft 365 customers used device code phishing to obtain authentication tokens (BleepingComputer).
| Kit feature | What a scanner meets | What the intended victim meets |
|---|---|---|
| Geofencing | A visit from outside the target countries: no lure page | The page in the expected country, language and brand |
| Fake CAPTCHA gate | A challenge that automated browsing does not clear | A challenge a person clears, then the lure |
| IP allow and block lists | A refusal when the address is on a block list | The page, when the address is served |
| Live operator | No session to observe | An operator who sees each entry and picks the next screen |
Table is AegisAI's reading of the features reported by BleepingComputer, The Hacker News and SecurityWeek.
What do the lures look like in the inbox?
They look like the notices recipients already expect. The reported themes are unpaid tolls, traffic penalties, delivery problems and account verification requests (BleepingComputer). Most US-targeted lures impersonate transportation or government entities, such as traffic and parking fee authorities (SecurityWeek).
Iron Man System
Resecurity counted 2,360 lure packages in its licensed copy, covering 130 countries and areas, with the newest dated 1 October 2026. Postal and courier brands are the largest group, followed by tax agencies, banking, telecoms, loyalty programs and toll or traffic-fine authorities. The most-used brands by template count are DHL (37), DPD (24), Apple (23), GLS (22) and the Spanish tax authority (16) (Resecurity). The takedown announcement counted more than 2,335 templates across 139 countries, a slightly different count of the same kit (The Hacker News).
CoGUI
CoGUI has been active since at least October 2024, mainly impersonating consumer and finance brands in Japan, among them Amazon, PayPay, MyJCB, Apple, Orico and Rakuten, and it has two variants, CoAceV and CoFish_Ws (The Hacker News).
These kits sell the lure, the host and the hiding place as one subscription.
AegisAI Threat IntelligenceWhy do email gateways and URL scanners miss gated phishing pages?
Because the check that matters happens at the wrong visitor. A gateway or link scanner fetches the page from its own network, outside the target country, without the human signals the kit waits for. The kit is built to return nothing useful to that visitor, so the verdict is clean while the page stays live for the victim.
Three other signals fail for related reasons. The sending address can be fresh and unremarkable. The destination can be a SharePoint or OneDrive location on a real tenant. And the domain churns: reporting (The Hacker News) puts roughly 17,000 unique domains behind the kits, and more than 100,000 domains are now being blocked, so a blocklist is always behind. The message itself is the one constant, a brand-themed request to act now.
How AegisAI protects against it
The reporting does not split email from SMS, so the point here is the email share of this traffic. Where a kit's link reaches a mailbox, the inbox is the last place the message can be judged.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.
More on how that works: inbound email security.
What the reporting does not tell us
Delivery. The more than one billion messages are reported as emails and SMS together. The reporting does not give the email share, the sending method or the share that reached an inbox.
Domains. Roughly 17,000 unique domains is reported for the kits, but accounts differ on which kits that figure covers. No current list of active lure domains was published.
Scale of the dent. Over 20,000 accounts and 100,000 domains are reported, but not what share of the ecosystem that is or how fast operators can rebuild.
Attribution. The announcement names no arrests and does not say whether the kit developers or YAM Store operators have been identified.
MITRE ATT&CK mapping
| ID | Name | Use in this campaign |
|---|---|---|
T1566.002 | Phishing: Spearphishing Link | Brand-themed lures point recipients at a kit-hosted page that is gated against scanners. |
T1583.001 | Acquire Infrastructure: Domains | Operators bought expired domains of real organizations and rebuilt their sites to obtain cloud accounts. |
T1111 | Multi-Factor Authentication Interception | Operators watch the session live and prompt victims for one-time verification codes. |
T1528 | Steal Application Access Token | Many messages aimed at Microsoft 365 customers used device code phishing to obtain tokens. |
Mapping by AegisAI; the original research does not assign technique IDs.
Recommendations for defenders
- Do not treat a clean link verdict as final. Re-evaluate links after delivery and when they are clicked, and weigh what the message asks for alongside what the scanner saw.
- Score the request in brand-themed urgency mail. Toll, parking fine, delivery, tax and account verification notices should be judged on the action they demand, even when the sender and link look clean.
- Treat links into shared storage as unverified. A SharePoint or OneDrive link from a tenant the organization has never dealt with should raise risk rather than inherit the platform's reputation.
- Move staff and administrators to phishing-resistant sign-in. Passkeys or FIDO2 keys defeat the one-time code capture these kits perform, and device code flow should be restricted where it is not needed.
- Make reporting and retraction fast. A report path for the first delivered copy, and the ability to pull every copy from mailboxes, limits a campaign that rotates domains daily.
FAQ
What is YAM Store?
YAM Store is a Chinese-language marketplace and initial access broker, tracked as Storm-3119. It sold compromised or fraudulently obtained Microsoft and Google cloud accounts, licenses and storage, and advertised the CoGUI, Haozi and Iron Man System phishing kits. Microsoft and Health-ISAC disrupted it under a federal court order announced on 14 October 2026.
How do phishing kits evade traditional email security filters?
The kits gate the landing page with geofencing, fake CAPTCHA challenges and IP allow and block lists, so a security scanner that visits the link sees nothing to flag while the intended victim sees the lure. The message itself can be clean, and the page can be hosted on a real cloud tenant with a good reputation.
How can organizations stop mass phishing campaigns that rotate domains and templates?
Block lists lag behind campaigns that use thousands of domains and thousands of brand templates. Organizations can judge the request in the message, re-check links after delivery and at click time, treat unfamiliar shared-storage links as unverified, and use phishing-resistant sign-in so a captured password or code is not enough.
Did the takedown stop the YAM Store phishing kits?
It disrupted them. The court order let Microsoft and Health-ISAC seize and redirect domains, and over 20,000 YAM Store accounts were disabled. The reporting does not say how quickly operators can rebuild, and Resecurity notes that the Iron Man System panel depends on a vendor license server that has not been reported as disabled.
References
- Resecurity (14 Oct 2026). Iron Man and YamStore: powering a global phishing-as-a-service ecosystem. resecurity.com
- BleepingComputer (14 Oct 2026). Global takedown hits network behind 1 billion phishing messages. bleepingcomputer.com
- The Hacker News (14 Oct 2026). Microsoft disrupts 3 phishing kits linked to over 1 billion scam messages. thehackernews.com
- SecurityWeek (14 Oct 2026). Microsoft disrupts Chinese-language phishing market behind 1B messages. securityweek.com
- Cybersecurity Dive (Oct 2026). Phishing marketplace takedown by Microsoft and Health-ISAC. cybersecuritydive.com
- TRM Labs (14 Oct 2026). TRM supports takedown of Chinese-language cybercrime ecosystem. trmlabs.com
- Japan Cybercrime Control Center, JC3 (14 Oct 2026, updated 15 Oct). Press release on the YAM Store, CoGUI and Iron Man disruption. jc3.or.jp
- MITRE ATT&CK. T1566.002, T1583.001, T1111, T1528. attack.mitre.org
Related posts
More from the AegisAI blog.