Search — “Storm-2990”
1 story · 0 IoCs
Stories
Microsoft maps Storm-2990 phishing kits and Storm-3119 YAM Store tenant-hijacking marketplace
Microsoft detailed a Chinese-language PhaaS ecosystem: Storm-2990 develops CoGUI, Haozi and Iron Man System phishing kits, sold alongside hijacked or fraudulent Microsoft 365/Google tenants by the YAM Store broker (Storm-3119). Storm-3119 abuses stolen app client secrets for app-only directory control, silently resets passwords, self-provisions the PnP Management Shell service principal with broad Graph/SharePoint permissions, and uses SharePoint/OneDrive as bulk hosting. Downstream actors run credential and device-code phishing against financial, healthcare and IT targets. Hunt for PnP Management Shell consent/service principal creation, app-only password resets without forced change, AppCatalog.ReadWrite.All grants, and device code sign-ins.