Microsoft-led operation disrupts three global phishing kits
Microsoft, Health-ISAC, the Japan Cybercrime Control Center (JC3), and private-sector partners have disrupted three phishing kits—CoGUI, Haozi and Iron Man System—linked to more than one billion phishing email and SMS messages sent to over 75,000 organizations worldwide since January 2026.
The court-authorized operation followed a Microsoft investigation launched in late 2025 after malicious messaging campaigns targeted people in Japan. The coalition included Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft said the activity reached consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries.
A marketplace for phishing tools and compromised cloud environments
Microsoft tracks the underground marketplace known as YAM Store as Storm-3119 and the developers of the three kits as Storm-2990. The Chinese-language ecosystem combines phishing-kit operators, developers, infrastructure sellers and initial-access brokers. Its customers could buy kits and access to compromised or fraudulently obtained Microsoft or Google environments for high-volume credential theft.
YAM Store advertised CoGUI and Haozi first, then began advertising Iron Man System in June 2026. It accepted cryptocurrency payments including USDT and Ethereum. The marketplace also promoted infrastructure associated with legitimate, expired or previously used organizations, enabling other criminals to acquire assets for attacks.
Microsoft said the three kits share capabilities and infrastructure, an indication of shared development origins, code reuse or close collaboration among Chinese-speaking developers. Their templates impersonated organizations in government, finance and logistics, while campaigns targeted healthcare, financial services, wholesale distribution and IT organizations in Japan, the United States, Australia and India.
How the operation supported credential theft
Storm-3119 used automation to identify expired organization names, profile cloud-enabled organizations and discover Microsoft 365 tenants. The reconnaissance activity took place anonymously through Tor infrastructure. After identifying viable environments, operators took them over and managed them through app-only administrative panels built with PHP, Java/Spring and Cloudflare Workers.
Within compromised tenants, the actors granted themselves broad Microsoft Graph permissions and full control of the SharePoint API. They then abused SharePoint and OneDrive for bulk hosting, turning hijacked storage into a product that could be sold alongside accounts, licences and phishing kits through an automated storefront.
About 17,000 unique domains were used by the three kits. CoGUI had been active in real-world campaigns since at least October 2024 and impersonated brands including Amazon, PayPay, MyJCB, Apple, Orico and Rakuten in attacks on Japanese organizations. By mid-2026, TRM Labs observed CoGUI increasingly being replaced by Iron Man System.
Templates, evasion and a defender advantage
Microsoft said Iron Man System contained more than 2,335 phishing templates tailored to trusted brands and organizations in 139 countries, including Australia, Japan, India and the United States. Resecurity, which examined a licensed deployment in an isolated lab, reported 2,360 distinct lure packages across 130 countries and regions. It also identified a self-hosted Git and container-registry server with 911 admin-panel builds dating from October 2025 to June 2026.
The kits used fake CAPTCHA gates, IP block and allow lists, and Telegram alerts when a victim interacted with a lure. Information entered into phishing pages was captured through WebSocket connections, allowing operators to monitor activity in real time and determine subsequent content shown to targets. Stolen financial data could then be used for fraudulent purchases or transactions.
Resecurity noted that Iron Man System required regular contact with its vendor licensing server, creating a dependency that could degrade active deployments if defenders disable or sinkhole the authorization host. For businesses, the case reinforces the need to protect cloud tenants, audit privileged Microsoft Graph and SharePoint permissions, and ensure employees verify unexpected messages before providing sign-in or financial information.