Microsoft Threat Intelligence and the Digital Crimes Unit (Oct 14) describe a Chinese-language phishing ecosystem. YAM Store (Storm-3119) is an access broker that hijacks or fraudulently creates Microsoft 365 / Azure for Education and Google tenants, then resells accounts, licenses and SharePoint/OneDrive storage. Kit developers tracked as Storm-2990 sell CoGUI, Haozi and Iron Man System (2,335+ templates for 139+ countries, with geofencing, fake CAPTCHA gates and live Telegram/WebSocket credential capture). Microsoft says the kits enabled more than 1 billion phishing emails and SMS messages to over 75,000 organizations since January 2026, hitting healthcare, finance, wholesale and IT in Japan, the US, Australia and India. Downstream actors also used device code phishing. Proofpoint says CoGUI and the related CoAceV and CoFish_Ws kits are the highest-volume direct email threats in its data, with about 17,000 domains seen. Microsoft and co-plaintiff Health-ISAC filed a civil suit in the U.S. District Court for the Southern District of Florida and seized or redirected the enabling domains, with help from JC3, Resecurity, Cloudflare, Oracle and TRM Labs.