Search — “CoGUI”

Microsoft, Japan's National Police Agency, Health-ISAC and partners obtained a U.S. court order to seize and redirect domains underlying the YAM Store initial access broker and the CoGUI and Iron Man phishing-kit platforms. The platforms reportedly enabled over 750 million messages targeting Microsoft customers, impersonating 75,000+ organizations, with credential theft aimed at Microsoft 365 and other logins. Microsoft also disabled more than 20,000 accounts tied to YAM Store and is blocking over 100,000 impersonation domains; hunters should watch for abuse of expired or lookalike domains and fraudulent Microsoft 365 and Google tenants, but the source prints no concrete technical artifacts.

Microsoft detailed a Chinese-language PhaaS ecosystem: Storm-2990 develops CoGUI, Haozi and Iron Man System phishing kits, sold alongside hijacked or fraudulent Microsoft 365/Google tenants by the YAM Store broker (Storm-3119). Storm-3119 abuses stolen app client secrets for app-only directory control, silently resets passwords, self-provisions the PnP Management Shell service principal with broad Graph/SharePoint permissions, and uses SharePoint/OneDrive as bulk hosting. Downstream actors run credential and device-code phishing against financial, healthcare and IT targets. Hunt for PnP Management Shell consent/service principal creation, app-only password resets without forced change, AppCatalog.ReadWrite.All grants, and device code sign-ins.