The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft uncovered a sophisticated Chinese-language cybercriminal marketplace where operators (Storm-2990 and Storm-3119) sold ready-made phishing kits, infrastructure, and tooling as a service — enabling low-skill actors to launch massive campaigns with minimal effort. The ecosystem facilitated over one billion phishing emails and SMS messages in under a year, demonstrating how commoditized crime platforms dramatically lower the barrier to entry for attackers. The root problem is that organizations and individuals remain vulnerable to well-crafted phishing lures, especially when attackers have access to polished, professionally maintained toolkits. This matters because even a single successful phishing attempt can grant attackers an initial foothold for credential theft, ransomware, or espionage. Disruption required cross-sector collaboration, underscoring that no single organization can combat industrialized cybercrime alone.