In a significant cybersecurity operation, Microsoft, in collaboration with Health-ISAC, the Japan Cybercrime Control Center (JC3), and several private companies, has successfully disrupted three major phishing kits. These kits, identified as CoGUI, Haozi, and Iron Man System, were responsible for distributing over one billion fraudulent emails and SMS messages worldwide.
Extensive Cybersecurity Collaboration
Since January 2026, these phishing kits have targeted more than 75,000 organizations globally, as noted by the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit. This court-approved operation started following reports of malicious campaigns in Japan and highlights the collaborative efforts between various entities, including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
The cybercriminal ecosystem, primarily Chinese-speaking, operates as an interconnected network involving phishing kit developers and an illicit marketplace known as YAM Store. This platform facilitates large-scale phishing attacks by leveraging compromised or fraudulently obtained Microsoft or Google environments.
Phishing as a Service Platforms
Microsoft has been monitoring this underground marketplace, codenamed Storm-3119, with the phishing kit developers identified as Storm-2990. The phishing kits share infrastructure and capabilities, suggesting joint development efforts or code reuse among their creators. These platforms provide fake templates that mimic legitimate brands, enabling widespread phishing and credential theft across sectors like government, finance, and logistics.
The kits have been sold via YAM Store, which accepts cryptocurrency payments, further obscuring these illicit activities. The marketplace advertises legitimate infrastructures associated with expired organizations, allowing criminals to launch targeted attacks.
Advanced Techniques and Global Impact
Storm-3119 employs sophisticated techniques, including automation to exploit expired organizational names and anonymous reconnaissance via Tor. They gain control of compromised environments, granting themselves extensive permissions and using SharePoint and OneDrive for bulk hosting.
The operation’s impact spans more than 150 countries, with phishing efforts targeting diverse sectors. Notably, the Iron Man System has introduced thousands of phishing templates impersonating trusted brands across numerous countries.
Resecurity revealed that regular communication with a licensing server is necessary for the kit’s operation, a dependency that defenders could exploit by disrupting the authorization host.
Microsoft’s disruption of these phishing kits is a crucial step in combating global cybercrime. By targeting the infrastructure and tools used by cybercriminals, the operation makes it increasingly difficult for malicious actors to conduct their activities, ultimately protecting victims worldwide.
