On October 14, 2026, Microsoft described a phishing ecosystem: Storm-3119 supplies compromised or fraudulently created cloud environments, while Storm-2990 develops phishing kits. The report connects stolen credentials, abused Microsoft 365 resources, and downstream attacks. For businesses with 10 to 250 employees, the task is to review internal email protection and secure privileged identities. Microsoft does not single out German small businesses; it states that these techniques could affect any organization.
How this phishing ecosystem operates
Storm-3119 operates the YAM Store marketplace. Microsoft explains how compromised accounts and cloud resources are sold to other attackers. The investigated workflow includes stolen application credentials, privileged directory access, and abuse of SharePoint and OneDrive as hosting infrastructure. Storm-2990 tracks the developers behind the CoGUI, Haozi, and Iron Man System kits. Downstream actors use the infrastructure for activities including credential theft, device code phishing, and financial fraud. These are different roles within a supply chain, not interchangeable names for the same threat actor.
Why familiar senders are not enough
Microsoft’s findings show that attacks do not rely exclusively on obviously unfamiliar infrastructure. Compromised cloud resources can contribute to the deception. For teams managing smaller Microsoft 365 environments, protection should therefore not depend solely on the apparent sender address. Microsoft explicitly recommends applying Safe Links to internal recipients. A review of Microsoft Defender should cover the internal message path and the recipients actually protected, rather than focusing only on messages arriving from outside the business.
- Verify urgent payment or sign-in requests through an independent contact channel.
- Teach employees to question suspicious links, text messages, and unexpected sign-in prompts.
- Do not automatically exclude internal messages from malicious-link inspection.
- Report suspicious messages and sign-ins to a clearly designated responsible person.
Deadlines and timing
The October 14, 2026 publication is a current reason to review protection, not a technical migration deadline. Microsoft specifies neither a mandatory retirement date nor a universal patch for this phishing ecosystem. The action is to examine existing safeguards. Our editorial recommendation is to schedule that review promptly; suspicious sign-ins or messages should trigger immediate investigation. Assigning a particular completion date would invent a deadline that the source does not provide. Likewise, the infrastructure described in the report is not evidence that your own tenant has been compromised.
Which settings deserve attention
Microsoft Learn documents the Safe Links setting Apply Safe Links to email messages sent within the organization, with enabled as the recommended value. What matters is the effective policy, including recipient conditions and exceptions, rather than the mere existence of a configuration. Safe Links checks links at click time, but has documented limitations, including certain message formats. A configuration review must therefore not promise complete protection against every phishing attempt or message type.
- Record effective Safe Links policies, internal-message coverage, and recipient exceptions.
- Compare email protection settings with Microsoft’s documented security recommendations.
- Review privileged roles and permissions that are broader than operationally necessary.
- Investigate suspicious sign-ins using the Defender and Entra signals named in the report.
For administrative access, Microsoft recommends phishing-resistant MFA. Deployment through Microsoft Entra ID needs preparation: register suitable authentication methods, account for emergency access, and evaluate policies in report-only mode first. Microsoft explicitly warns about administrator lockout if registration is not completed beforehand. Conditional Access policies scoped to users also do not block calls made by service principals; application access requires separate consideration rather than assuming that user MFA covers it.
Concrete next steps for smaller teams
Our practical recommendation is a focused review rather than an indiscriminate redesign. Document current settings and ownership first, then test justified changes in a controlled manner. The result should identify which accounts and message paths are covered, and which exceptions remain. This sequence is a suggested approach, not a Microsoft-mandated deadline. Distinguish detection from prevention: Microsoft attributes the listed Defender detections to observed downstream activity, not guaranteed coverage of every variant.
- Assign responsibility for reviewing email protection and privileged identities.
- Check Safe Links coverage and administrative access against the primary sources.
- Prepare and test MFA changes, reviewing report-only results before enforcement.
- Record findings, approved configuration changes, and any remaining exceptions.
Official Microsoft sources
The starting point is Microsoft’s report on Storm-2990 and Storm-3119. Technical references are the Safe Links documentation, the recommended email protection settings, and the guide to phishing-resistant administrator MFA.
If you want to review email protection and privileged access in your Microsoft 365 environment, we can support a focused technical review – talk to us.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
