Microsoft Uncovers Global Chinese‑Language Phishing Campaign Leveraging Yam Store Marketplace

Microsoft and a coalition of security partners have disclosed a massive phishing operation that exploited the Chinese‑language app marketplace known as Yam Store, sending roughly one billion fraudulent messages worldwide.

The investigation traced the campaign to a network of compromised and malicious applications hosted on Yam Store, a platform that serves millions of users across Asia and the diaspora. Attackers embedded deceptive login pages and credential‑stealing tools within seemingly legitimate apps, then used automated services to broadcast phishing emails and SMS texts on a global scale.

According to the joint report, the malicious payloads were distributed under the guise of popular utilities, games, and productivity tools. Once installed, the software harvested usernames, passwords, and two‑factor authentication codes, forwarding the data to command‑and‑control servers operated from several jurisdictions.

Microsoft said the scale of the operation was unprecedented for a single marketplace, noting that the estimated one‑billion‑message volume dwarfs most previously documented phishing bursts. The company leveraged its threat‑intelligence platform and collaborated with law‑enforcement agencies, regional CERTs, and the Yam Store operator to disrupt the infrastructure and remove the offending apps.

Security experts highlighted that the campaign illustrates how regional app stores can become fertile ground for large‑scale credential theft, especially when they lack rigorous vetting processes. The incident also underscores the challenges faced by multinational corporations in monitoring threat vectors that span different languages, regulatory environments, and distribution channels.

In response, Microsoft announced plans to enhance its detection capabilities for non‑English phishing kits and to share more granular indicators of compromise with the broader security community. The firm also urged users to download applications only from trusted sources, verify app permissions, and employ multi‑factor authentication wherever possible.

While the takedown effort has curtailed the immediate threat, analysts caution that attackers may migrate to other less‑scrutinized platforms. Ongoing monitoring and coordinated action between tech firms, app store operators, and governmental bodies will be essential to prevent similar large‑scale abuses in the future.