Billion-Message Phishing Ecosystem Targeting Microsoft Users Dismantled
Storm-2990 operated a sophisticated, commoditized phishing-kit ecosystem that made credential theft scalable and accessible to a wide range of threat actors, resulting in over 1 billion malicious messages sent to 75,000+ organizations. The root failure is a combination of insufficient user security awareness — employees clicking phishing links and surrendering credentials — and weak account protections that allowed stolen credentials to be immediately weaponized. Phishing-as-a-service platforms like CoGUI dramatically lower the barrier to entry for attackers, meaning even unsophisticated criminals can launch high-volume, convincing campaigns. This matters because compromised credentials are a primary entry point for ransomware, business email compromise, and data breaches that can devastate organizations financially and reputationally.
Tactical Insight
Immediate actions
- Enforce phishing-resistant multi-factor authentication (e.g., FIDO2/passkeys) on all user accounts, especially Microsoft 365 and cloud services.
- Deploy anti-phishing email filtering with link rewriting, sandboxing, and sender authentication (SPF, DKIM, DMARC) at the email gateway.
- Immediately report and block known Storm-2990 indicators of compromise (domains, IPs) across all perimeter controls.
Long-term improvements
- Conduct regular, simulated phishing exercises to measure and improve employee resilience to credential-harvesting attacks.
- Adopt a Zero Trust architecture so that stolen credentials alone are insufficient to access sensitive systems or data.
- Maintain a monitored threat-intelligence feed to proactively identify new phishing kit variants targeting your organization.
Detection measures
- Enable sign-in anomaly alerting (impossible travel, new device, unfamiliar location) in your identity platform to catch credential misuse in real time.
- Monitor for bulk email rule creation or forwarding rules in user mailboxes, which are common indicators of post-phishing account compromise.
- Integrate SIEM alerting for high-volume outbound or inbound message patterns that may indicate phishing infrastructure abuse.