YAM Store

YAM Store, tracked by Microsoft as Storm-3119, is a financially motivated cybercrime marketplace and initial access broker supplying compromised or fraudulently obtained cloud infrastructure to phishing operators. It resells Microsoft and Google environments, accounts, software licenses, and storage through an automated storefront, including resources associated with education and nonprofit organizations. Its infrastructure supports campaigns targeting healthcare, financial services, wholesale distribution, and information technology organizations, particularly in Japan, the United States, Australia, and India. Storm-3119 automates reconnaissance to identify cloud-enabled organizations, discover Microsoft 365 tenants, and assess licensing and enrollment opportunities. Operators acquire expired organizational domains and rebuild websites to make former organizations appear active, then use those identities to obtain cloud accounts fraudulently. They also establish fictitious organizations. Within compromised tenants, the group uses stolen application credentials and application-only administrative access to maintain persistence, reset passwords, assign licenses, and grant privileged permissions. Broad Microsoft Graph and SharePoint permissions enable the takeover and resale of SharePoint and OneDrive storage for hosting and distributing phishing content. YAM Store distributes the CoGUI, Haozi, and Iron Man System phishing kits. Their developers are tracked separately as Storm-2990; that designation is not an alias for YAM Store. CoGUI is also known as NX or FA, and Haozi as Phoenix. These kits support brand impersonation, credential and payment-data harvesting, real-time victim interaction, and analysis-evasion mechanisms. The wider ecosystem also uses device-code phishing to obtain authentication tokens. Since January 2026, the interconnected services enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. In October 2026, Microsoft, Health-ISAC, and partners undertook a court-authorized infrastructure disruption, including domain seizures and the deactivation of more than 20,000 YAM Store-linked accounts.