Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Summary: Microsoft, Health-ISAC, JC3 and a coalition including Cloudflare, Oracle, Proofpoint and TRM Labs announced the disruption of three phishing kits - CoGUI, Haozi and Iron Man System - whose operators Microsoft says sent over one billion phishing emails and SMS messages to more than 75,000 organizations since January 2026. The court-authorized operation followed a Microsoft investigation opened in late 2025 after notification of campaigns targeting people in Japan, and centers on the Chinese-language ecosystem tracked as Storm-3119, kit developers tracked as Storm-2990, and the YAM Store marketplace that sold the kits and access to compromised or fraudulently obtained Microsoft and Google environments.
Key Takeaway: Health-ISAC attributes tens of millions of dollars in operator revenue to messages that reached consumers, healthcare organizations and financial institutions in more than 150 countries, and Resecurity found the Iron Man kit needs regular contact with a vendor licensing server - meaning sinkholing that one authorization host could degrade every active deployment at once.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026