The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

1. Executive summary

Microsoft's Digital Crimes Unit, working with Resecurity and law enforcement partners, has published research on a Chinese-language phishing ecosystem built around three commercially licensed phishing kits (CoGUI/NX/FA, Haozi/Phoenix, and Iron Man System) sold through an underground marketplace Microsoft tracks as Storm-3119, with the kit developers tracked as Storm-2990. Microsoft attributes over one billion phishing emails and SMS messages sent to more than 75,000 organisations since January 2026 to actors using these kits, with financial services named among the targeted sectors in Japan, the United States, Australia, and India. The kits are phishing-as-a-service products that impersonate financial, government, and logistics brands, harvest credentials and card data over WebSocket with live Telegram operator control, and are supplied by an initial access broker reselling hijacked Microsoft 365 and Azure for Education tenants. No CVE, CVSS score, or CISA KEV entry applies to this item; the risk is credential and session compromise through social engineering, not software exploitation. Neither Storm-3119 nor Storm-2990 has a MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed and should be treated as vendor-assigned cluster naming only.

2. Regulatory framing

3. Technical analysis & attack chain

This is a threat-campaign item describing a criminal supply chain, not a software vulnerability. There is no exploited CVE, no patch, and no CVSS score to apply. The chain below is the supply side as Microsoft describes it, followed by the downstream phishing operation.

1. Reconnaissance. Storm-3119 runs automated reconnaissance against cloud-enabled organisations using Flask, a Python web framework, to discover Microsoft 365 tenants, assess enrolment opportunities, and gather licensing and Azure cloud information. The tooling routes through Tor to keep the profiling anonymous.
2. Environment takeover and app-only admin panels. Once a viable tenant is identified, the actor centralises the associated information in administrative panels built in PHP, Java/Spring, and Cloudflare Workers. Using the compromised environment's client secret in an application-only authentication flow, the panel resets passwords silently without forcing a change at next sign-in, assigns education licences, and grants privileged attributes for later resale. Because the access is application-level rather than tied to a user session, the persistence survives password resets and is harder to detect than a stolen user credential.
3. Storage and resource abuse. The actor signs in to a compromised Global Administrator account and self-provisions the PnP Management Shell service principal, which represents the actor's application inside the tenant. Through that service principal the actor grants broad Microsoft Graph permissions, including read and write access to directory data and AppCatalog.ReadWrite.All, plus full control over the SharePoint API. The hijacked SharePoint and OneDrive storage is then used as bulk hosting and sold as a product.
4. Phishing and DNS infrastructure support. A custom DNS management platform gives centralised control of phishing domains, SSL certificates, and domain-routing configuration through Cloudflare.
5. Storefront and monetisation. Hijacked accounts, licences, and storage are resold through an automated storefront with a sub-reseller tier. Payment is accepted via Alipay, WeChat Pay, and USDT (TRC20). Telegram carries order notifications and buyer contact rather than acting as the primary sales channel.

Downstream, the three kits are sold as subscriptions. Iron Man System customers get access to a licence server with the domain hard-coded into the kit, which limits site access to paying customers. The kit carries over 2,335 templates covering more than 139 countries, with the United States accounting for the most templates; lures impersonate local government (including traffic and parking fee authorities), law enforcement, healthcare, finance, transportation, and retail. When a target submits sign-in details or card data, the kit collects it over a WebSocket and pushes real-time Telegram notifications to the operator, who can watch each victim's progress and manually control what the victim sees next. Iron Man System panels are predominantly hosted on China-based providers, with a smaller number elsewhere, and the kit uses the GoFrame Go application framework.

Storm-3119 also creates fraudulent organisations from scratch to obtain tenants, likely using AI-generated content and forged documentation. Microsoft cites one environment named "Jewish Choice", presented as a nonprofit and associated with jewishchoice[.]org, a domain registered within the past several months that did not appear to represent a legitimate organisation.

Confidence caveats. The entire technical picture here rests on a single vendor publication, Microsoft's Security Blog post of 2026-10-14, with Resecurity named as a partner on kit identification. The one billion messages, the 75,000 organisations, the sector and country targeting, and the five-stage pipeline are Microsoft's figures and have not been independently corroborated in the material available to us. The attribution of the kits to Chinese-speaking developers is Microsoft's assessment at high confidence; neither Storm-3119 nor Storm-2990 has a MITRE ATT&CK profile in our reference data, so these are vendor cluster designations, not confirmed tracked actors. Microsoft states the disruption of the ecosystem's primary developers and infrastructure was facilitated with law enforcement, but gives no detail on what was taken down, when, or how durable the effect is. Do not treat this as a takedown that removes the kits from circulation.

4. Mitigation & containment

P1 within 24 hours

• Hunt for application-only authentication events in Microsoft Entra ID where the client credential is a service principal rather than a user, and where the sign-in is followed by password resets that did not force a change at next sign-in. Silent password reset without a next-sign-in change prompt is the specific behaviour Microsoft describes in stage 2 and is the highest-value detection in this advisory.
• Audit for self-provisioned PnP Management Shell service principals in every Microsoft 365 tenant you operate. Where one exists that your administrators did not create, treat the tenant as compromised and revoke the service principal's credentials.
• Review Microsoft Graph permission grants for AppCatalog.ReadWrite.All and for directory read and write scopes on service principals. Remove any grant that cannot be tied to a documented business application.
• Check SharePoint and OneDrive for bulk hosting of content you did not place, particularly large volumes of HTML or files served to external parties. Hijacked storage is resold as hosting, so unexplained public content is a compromise indicator.
• Enforce phishing-resistant MFA (passkeys) on all privileged and Global Administrator accounts. Microsoft names passwordless solutions and MFA as the primary hardening step; for the application-only flow described here, MFA alone does not stop the abuse, which is why service principal review is the P1 action.

P2 within 72 hours

• Add detection for the downstream sign-in patterns Microsoft lists: atypical travel, sign-in from a malicious IP address, unfamiliar sign-in properties, and password spray against Entra ID.
• Block or alert on outbound connections to newly registered domains used in lures, and enable Defender for Office 365 URL detonation for inbound mail. Microsoft's coverage table lists "A potentially malicious URL click was detected" and "Email messages containing malicious URL removed after delivery" as the relevant signals.
• Verify the provenance of any counterparty domain tied to an expired or previously used organisation number before trusting it in payment or onboarding workflows. YAM Store sells exactly this class of domain, so a legitimate-looking .edu or .org counterparty domain is not evidence of legitimacy.
• Review card-not-present fraud alerts against recent phishing lures impersonating traffic, parking, and government fee payment, which Microsoft identifies as the dominant US lure themes.

P3 within 7 days

• Extend the ICT third-party register to cover cloud identity provider concentration and the domain provenance risk described in §2.
• Add the Storm-2990 kit behaviours to email and identity detection content: WebSocket-based credential collection and Telegram notification traffic from phishing pages.
• Where Microsoft Defender XDR is licensed, pull the threat analytics reports Microsoft references for this activity and reconcile them against your own telemetry.

5. Indicators of compromise

The source material contains no file hashes, IP addresses, or command-and-control domains suitable for atomic enforcement. It names one domain, jewishchoice[.]org, which Microsoft associates with a fabricated nonprofit tenant created by Storm-3119; it is included below as a single-sourced indicator for monitoring, not for blanket blocking.

domain  jewishchoice[.]org

The sources describe observable behaviours rather than atomic indicators. Those are set out separately below and are not machine-pivotable in the same way as a hash or domain.

Behavioural indicators

6. Detection

The sources give usable behavioural and configuration artefacts for a Sigma rule but no file-level artefacts (no hashes, no malware strings, no filenames), so a YARA rule is not appropriate here. The Sigma rule below targets the application-only authentication and silent password reset pattern Microsoft describes in stage 2, which is the most distinctive and highest-value detection in this advisory.

title: Application-Only Authentication Followed by Silent Password Reset
id: 8f3c1a72-4d5e-4b91-9c2a-7e6f0d1b3a48
status: experimental
description: Detects the Storm-3119 stage 2 pattern in which a compromised tenant client secret is used in an application-only authentication flow and is followed by a password reset that did not force a change at next sign-in. Single-sourced from Microsoft Security Blog, 2026-10-14.
author: Adverse Trace
date: 2026-10-14
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/
logsource:
  product: azure
  service: auditlogs
detection:
  selection_app_auth:
    OperationName:

      - 'Add service principal'
      - 'Add app role assignment grant to user'
      - 'Consent to application'
    ActorType: 'Application'
  selection_password_reset:
    OperationName:

      - 'Reset user password'
      - 'Change user password'
    ResultStatus: 'Success'
  filter_forced_change:
    ForceChangePasswordNextLogin: 'true'
  condition: selection_app_auth or (selection_password_reset and not filter_forced_change)
falsepositives:

  - Legitimate administrative automation that resets passwords without forcing a change, which should be documented and excluded by actor or application ID
level: high

7. Sources

• Microsoft Security Blog, "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime", https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/, 2026-10-14. Single source for all technical detail in this advisory; Resecurity named as identification partner.

8. Adverse Trace position

Adverse Trace assesses this as a high-relevance, medium-urgency item for EMEA financial services clients. There is no CVE, no CVSS score, and no CISA KEV entry, so it does not enter our vulnerability remediation queue; the exposure is credential and session compromise through phishing that impersonates financial and government brands, and the specific technical risk to a Microsoft 365 or Azure tenant is the application-only access path Microsoft describes, which survives password resets and is not stopped by MFA on user accounts. We treat the attribution as unconfirmed: neither Storm-3119 nor Storm-2990 has a MITRE ATT&CK profile in our reference data, and the entire technical picture is single-sourced to one Microsoft publication, so the one billion message figure, the 75,000 organisation figure, and the five-stage pipeline should be read as vendor-reported and not independently corroborated. We will monitor for additional reporting on the disruption Microsoft says it facilitated, since the source gives no detail on scope or durability, and we will issue a follow-up if the kits reappear under new branding or if independent telemetry confirms the application-only authentication pattern in financial sector tenants. Clients running Microsoft 365 should prioritise the P1 service principal and Graph permission audit in §4 this week; that is the action that closes the specific access path described here.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.