Microsoft and Partners Shut Down Three Phishing Kits Tied to a Billion-Plus Scam Messages

Microsoft, Health-ISAC, the Japan Cybercrime Control Center and a group of private companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs have announced the disruption of three phishing kits: CoGUI (also known as NX or FA), Haozi (also known as Phoenix) and Iron Man System.

According to Microsoft's Threat Intelligence team and its Digital Crimes Unit, the actors behind these kits have facilitated more than one billion phishing emails and SMS messages sent to over 75,000 organizations worldwide since January 2026. The court-authorized operation grew out of an investigation Microsoft began in late 2025 after being notified of malicious messaging campaigns aimed at people in Japan.

Microsoft describes the Chinese-language cybercriminal ecosystem as an interconnected network of kit operators, developers and an illicit marketplace and initial access broker called YAM Store, which sells tools and infrastructure built on compromised or fraudulently obtained Microsoft or Google environments. Microsoft tracks the marketplace as Storm-3119 and the developers behind all three kits as Storm-2990, noting that the kits overlap in capabilities and infrastructure, suggesting shared development origins, code reuse or close collaboration.

As with any phishing-as-a-service platform, the kits supply templates impersonating government, financial and logistics brands to enable high-volume credential theft. Health-ISAC said the messages have targeted consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for their operators. Buyers have used the kits and hijacked cloud environments against organizations in healthcare, financial services, wholesale distribution and IT in Japan, the U.S., Australia and India.

Microsoft said the kits were advertised through YAM Store, starting with CoGUI and Haozi and followed by Iron Man System from June 2026, with payments accepted in cryptocurrency including USDT and Ethereum. YAM Store also advertises legitimate infrastructure tied to legitimate, expired or previously used organizations for criminals to purchase.

Storm-3119's tradecraft includes using automation over Tor to find expired environments and Microsoft 365 tenants, taking over viable environments through app-only administrative panels built in PHP, Java/Spring and Cloudflare Workers, granting broad Microsoft Graph permissions and abusing SharePoint and OneDrive as bulk hosting, and reselling hijacked accounts, licenses and storage through an automated storefront.

Proofpoint reported in May 2025 that CoGUI targeted Japanese organizations by impersonating brands such as Amazon, PayPay, MyJCB, Apple, Orico and Rakuten, with real-world campaigns since at least October 2024. The three kits have used around 17,000 unique domains in total, and by mid-2026 CoGUI was increasingly being replaced by Iron Man System, according to TRM Labs.

Resecurity, which bought a license and deployed the kit in an isolated lab, said Iron Man System supports 2,360 phishing lure packages impersonating postal, tax, banking, telecom and loyalty-programme brands across 130 countries and regions. It also found a self-hosted Git and container-registry server holding 911 admin panel builds from October 2025 through June 2026, and noted the kit must contact the vendor's licensing server to function, a dependency that favors defenders.

Evasion techniques include fake CAPTCHA gates, IP-based block and allow lists, and Telegram alerts that notify operators when a victim acts on a lure. Data entered on phishing sites is captured via WebSocket so operators can watch in real time and decide what targets see next, with stolen financial information used by downstream actors for fraudulent purchases and transactions.

Steven Masada, associate general counsel and general manager of Microsoft's Digital Crimes Unit, said what began with scam activity targeting Japan led investigators to an underground service economy supplying criminals worldwide. He said YAM Store, CoGUI and Iron Man are only part of that larger network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on. The news comes less than a month after Microsoft announced the takedown of the EvilTokens device code phishing service.

Source: The Hackers News