Microsoft found YAM Store took over Microsoft 365 environments, gained top-level admin access, and sold the accounts to other criminals.

 

What happened

YAM Store, an underground marketplace disrupted by Microsoft and its partners on October 14, 2026, took over real organizations' Microsoft 365 and Google cloud environments and resold them to criminals running phishing campaigns, according to Microsoft's research. Microsoft tracks the marketplace as Storm-3119. It worked as an access broker, meaning it sold ready-made entry into other organizations' systems. Stock was sorted by account age, subscription type, and category, including education and nonprofit environments. Buyers used the tools against organizations in healthcare, financial services, wholesale distribution, and IT. Microsoft and Health-ISAC, the health sector's information-sharing organization, filed a civil lawsuit against the operators in federal court in Florida, GBHackers reported.

 

Going deeper

Microsoft described a five-stage process. The operators first used automated tools, run anonymously through the Tor network, to find Microsoft 365 environments and gather details about their licenses and cloud setup. Once they had access, they used an organization's stolen application credentials to take full control of its user directory, silently resetting passwords and assigning licenses. They then signed in to a compromised global administrator account, the highest level of control in Microsoft 365, and gave their own application broad permissions over the directory and SharePoint. With that in place, they used the organization's SharePoint and OneDrive storage to host material for buyers' phishing campaigns. Finally, they sold the hijacked accounts, licenses, and storage through an automated storefront.

 

What was said

Because the operators' access ran through an application rather than a single person's login, Microsoft said it was "more durable, more scalable, and harder to detect," in its analysis of the operation. The marketplace also revived organization names and domains that had been allowed to expire, and created fake organizations to set up new accounts. In one case, it built a website for a nonprofit that did not appear to exist, likely using AI-generated content, so the account would look legitimate in phishing emails. Microsoft said the activity is not limited to its own services and extends to other providers.

 

In the know

Cloud accounts belonging to vendors and other third parties are often slow to be secured, which leaves openings of exactly this kind. Only 23% of third-party organizations fully fixed missing or poorly configured multifactor authentication on their cloud accounts, according to Verizon's 2026 Data Breach Investigations Report. Half of those findings were resolved within a month. Weak passwords and permission problems took far longer, with the time to resolve half of them reaching almost eight months. Third parties were involved in 32% of healthcare breaches in the same data, which means a supplier's neglected cloud account can become a route into the organizations it serves.

 

The big picture

The marketplace sold nonprofit and education environments, a category that includes many health systems and academic medical centers. Microsoft's guidance focuses on the controls that would have limited the damage once an attacker got in. Organizations should limit who holds the global administrator role and require phishing-resistant authentication such as passkeys for privileged accounts, according to Microsoft's mitigation guidance. New authentication methods should only be registered from trusted locations and devices. Health systems that have merged, rebranded, or closed departments can also check for old Microsoft 365 tenants and domains still registered in their name, since forgotten environments are the kind the operators bought and resold.

 

FAQs

What is an access broker?

A criminal who gains entry to organizations' systems and sells that access to others, rather than carrying out the attack themselves.

 

What is a Microsoft 365 tenant?

An organization's own Microsoft 365 environment, holding its users, email, and files. Larger organizations sometimes accumulate several through mergers or old projects.

 

Why is application-level access harder to detect?

It doesn't depend on one person signing in, so it keeps working through password resets and doesn't show up as unusual activity on a single user's account.

 

Why would attackers want an organization's SharePoint storage?

Files and links hosted on a legitimate organization's storage look more trustworthy and are less likely to be blocked than those on a newly created site.

 

What should an organization do with old tenants it no longer uses?

Identify them, remove privileged accounts and stored credentials, and decommission them properly so they don't sit unmonitored or expire into someone else's hands.