Microsoft shuts down phishing kit marketplace behind billions of scams

Microsoft and security firm Resecurity have taken down an underground marketplace that sold phishing kits and cloud accounts used to send more than a billion scam messages worldwide. The operation, identified as YAM Store or Storm‑3119, provided tools that enabled attackers to target organisations in healthcare, financial services, wholesale distribution and IT across Japan, the United States, Australia and India.

The marketplace offered ready‑made phishing kits, which are collections of templates, scripts and instructions that make it easier for criminals to craft convincing fraudulent emails. It also sold compromised cloud accounts that could be used to host malicious payloads or to lend credibility to phishing campaigns. According to the report, the developers behind the kits operated under names such as CoGUI, also known as NX.

Victims of these campaigns include both large enterprises and smaller businesses that rely on email for daily operations. Phishing emails typically impersonate trusted brands or internal contacts, lure recipients to fake login pages, and harvest credentials. Once attackers obtain valid usernames and passwords, they can move laterally within networks, exfiltrate data or demand ransom.

Microsoft’s disruption involved seizing the infrastructure used by the marketplace and working with law‑enforcement partners to identify the operators. While the takedown removes a major supply source, the report notes that similar services may reappear under different names, so vigilance remains essential.

To reduce the risk of falling for phishing emails, users should verify the sender’s address, hover over links to see the actual URL, and avoid entering credentials on unfamiliar sites. Enabling multi‑factor authentication adds a layer of protection even if passwords are compromised. Free tools on ComputerScams.com, such as the email checker and password strength checker, can help users assess the safety of messages and the robustness of their passwords.

A practical step you can take right now is to enable multi‑factor authentication on all critical accounts and to run a quick password strength check on ComputerScams.com.

Source: Read the original report