Technology @ Your Service
Most people still picture phishing as one scammer sending one sketchy email. That picture is out of date. On October 14, 2026, Microsoft Threat Intelligence and the Microsoft Digital Crimes Unit published research on a Chinese-language cybercriminal ecosystem that works much more like a business supply chain: developers build phishing kits, a marketplace sells them along with ready-made cloud infrastructure, and paying customers run the campaigns.
The takeaway for business owners in Mid-Michigan is simple. You do not have to be a big target to be targeted. When phishing is sold as a service, attackers can reach thousands of organizations at almost no cost, and small and mid-sized businesses end up in the same pile as everyone else.
What Microsoft found
According to Microsoft, three phishing kits, CoGUI, Haozi and Iron Man System, were sold through an underground marketplace called YAM Store. Microsoft tracks the developers behind the kits as Storm-2990 and the marketplace itself as Storm-3119. Since January 2026, the actors behind these kits have facilitated the sending of over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide.
Microsoft describes the kits as commercially licensed phishing-as-a-service products. Customers buy a subscription, and the kit supplies the look and feel of trusted brands. Microsoft reports that one kit alone contains more than 2,335 templates tailored to more than 139 countries, with the United States accounting for the most templates. Microsoft says most of the lures used in the United States are transportation or government-related.
The marketplace also resold access to compromised or fraudulently obtained Microsoft and Google cloud environments. Microsoft describes YAM Store as an initial access broker that hijacks tenants and resells accounts, licenses and storage, and that also creates fake organizations, likely with AI-generated content, so phishing can come from infrastructure that looks legitimate. In collaboration with law enforcement and other partners, Microsoft's Digital Crimes Unit facilitated a disruption of the ecosystem's primary developers and infrastructure.
Why this matters to a small business
Industrial scale changes the math. When the hard parts are packaged and sold, less skilled criminals can launch convincing campaigns. Microsoft notes that while the identified victims include financial, healthcare and IT companies, the attacks are common ones that could affect any organization. The goals are familiar: stealing sign-in credentials, stealing payment card data, and committing financial fraud.
It also means a message can look polished. A lure that arrives from a real-looking cloud account, with professional branding and local language, will not always trip the "this looks fake" instinct.
Red flags your staff can spot
The good news is that the tells are consistent. Microsoft reports that in nearly all observed cases, the lures followed classic scam red flags. Share these with your team:
- Urgency and deadlines. "Act today," "final notice," or a time-sensitive task that pushes someone to click before thinking.
- Fake government notices. Unpaid tolls, traffic or parking fees, or messages claiming to be from law enforcement or a public agency.
- Shipping and delivery brands. Package problems, redelivery fees, or address confirmations.
- Finance and account alerts. A "routine security check" saying an account needs re-authentication, or a payment problem that needs card details.
- Text message lures. These campaigns use SMS as well as email. A text about a missed toll or a delivery deserves the same suspicion as an email.
- Sign-in pages you reached from a link. If a message sent you to a login page, treat it with caution.
The single best habit is the one Microsoft recommends: verify independently. Do not use the link or phone number in the message. Open the app or website you already know, or call the organization directly using a number you trust.
Practical defenses, straight from Microsoft's guidance
Training helps, but the strongest protection comes from making stolen passwords much less useful. Microsoft's recommendations in the post include:
- Passkeys and multifactor authentication everywhere. Microsoft recommends passwordless options like passkeys and MFA throughout your environment, using the Microsoft Authenticator app.
- Conditional Access. Complement MFA with Conditional Access policies that evaluate sign-ins using additional identity signals, and scope them to require phishing-resistant MFA for privileged accounts.
- Lock down how MFA is registered. Only allow MFA and passkey registration from trusted locations and devices.
- Least privilege for admin accounts. Microsoft observed these operators obtaining Global Administrator access. Keep the number of global admins small, separate admin accounts from everyday ones, and apply Zero Trust principles.
- Microsoft Defender for Office 365. Review the recommended settings for Exchange Online Protection and Defender for Office 365, and apply Safe Links to internal recipients too.
- Network protection. Turn it on so users and apps are blocked from reaching known malicious domains.
- Ongoing user education. Teach staff to recognize lures, filter unsolicited messages and report suspicious activity quickly.
How much does MFA help? A Microsoft Research study published in May 2023 found that MFA reduced the risk of account compromise by 99.22% across the population studied, and by 98.56% even when credentials had already leaked. It is one of the highest-value controls a business can turn on.
The gaps we often find at SMBs
When we review Microsoft 365 environments, the gaps we often find at SMBs are not exotic. MFA is on for some users but not all. Older sign-in methods are still allowed. Several people hold Global Administrator rights for convenience. Email protection is running on defaults that were never reviewed. And staff have no simple, blame-free way to report a suspicious message. Each of these is fixable, and fixing them is what turns an industrial-scale phishing campaign into noise.
Part of your team
The KW Managed IT team works as part of your team, not as a vendor you call after something goes wrong. We help Mid-Michigan businesses roll out MFA and passkeys, configure Conditional Access, right-size admin access, tune Microsoft Defender for Office 365, and give staff practical awareness training they will actually remember.
If you would like a second set of eyes on your Microsoft 365 security, we are glad to help. Contact KW Corp for a free quote.
KW Corporation | Technology @ Your Service
307 W. Grand River Ave, Fowlerville, MI 48836 | 517-223-3610 | support@kw-corp.com
Sources: Microsoft Security Blog, "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime" (Oct 14, 2026); Meyer et al., Microsoft, "How effective is multifactor authentication at deterring cyberattacks?" (May 2023).