Microsoft and Partners Take Down Three Phishing Kits Behind Over One Billion Scam Messages

Microsoft and Health-ISAC, working with the Japan Cybercrime Control Center and companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, have announced the disruption of three phishing kits: CoGUI, Haozi and Iron Man System. Microsoft says the people behind them have helped send more than one billion phishing emails and SMS messages to over 75,000 organisations since January 2026. The court-authorised operation followed an investigation Microsoft began in late 2025 after being alerted to malicious messaging campaigns aimed at people in Japan.

The kits are part of a Chinese-language cybercrime ecosystem that includes kit operators, developers and a marketplace called YAM Store, which also acts as an initial access broker. It sells tools and infrastructure that use compromised or fraudulently obtained Microsoft or Google environments for large-scale phishing. Microsoft tracks the marketplace as Storm-3119 and the developers as Storm-2990, and says the three kits overlap in capabilities and infrastructure, which suggests shared origins or close collaboration.

Like other phishing-as-a-service platforms, the kits supply templates that imitate trusted brands across government, finance and logistics, making high-volume credential theft easier. Health-ISAC says the messages targeted consumers, healthcare organisations, financial institutions and other businesses in more than 150 countries, earning operators tens of millions of dollars. Buyers targeted the healthcare, financial services, wholesale distribution and IT sectors in Japan, the U.S., Australia and India.