Microsoft Disrupts Three Major Phishing Kits Linked to Billion-Message Scam
Global coalition dismantles interconnected phishing-as-a-service network responsible for massive credential theft operations.
1Coordinated Global Takedown Operation
Microsoft, alongside Health-ISAC and the Japan Cybercrime Control Center, successfully disrupted three major phishing kits: CoGUI, Haozi, and Iron Man System. This court-authorized action targeted an interconnected network of developers and marketplaces. The operation aims to dismantle the infrastructure supporting large-scale credential theft campaigns that have impacted over 75,000 organizations worldwide.
2Scale of Phishing Operations
Since January 2026, threat actors utilized these kits to facilitate over one billion phishing emails and SMS messages. These campaigns targeted consumers and businesses across 150 countries, generating tens of millions of dollars. The malicious activity primarily focused on organizations within the healthcare, financial services, wholesale distribution, and information technology sectors.
3The YAM Store Ecosystem
The criminal network centers on the YAM Store, an illicit marketplace and initial access broker. It provides attackers with phishing templates and compromised cloud environments from Microsoft or Google. The platform accepts cryptocurrency payments, including USDT and Ethereum, to conceal financial trails while selling infrastructure previously used by legitimate, expired organizations.
4Tracking Storm-3119 and Storm-2990
Microsoft identifies the marketplace as Storm-3119 and the kit developers as Storm-2990. Evidence suggests significant overlap in capabilities and infrastructure between the three kits, indicating shared development origins or close collaboration. These developers continuously evolved their tradecraft, with Iron Man System increasingly replacing the older CoGUI kit by mid-2026.
5Advanced Phishing Kit Capabilities
The Iron Man System features over 2,335 templates impersonating global brands, while supporting 2,360 distinct lure packages. These kits employ sophisticated evasion techniques, including fake CAPTCHA gates to block automated security scanners. Operators monitor stolen data in real-time via WebSockets, allowing them to dynamically adjust the victim's experience during the attack.
6Licensing Dependency as Vulnerability
Resecurity discovered that the Iron Man System requires constant communication with a vendor-controlled licensing server to function. This architectural dependency provides a strategic advantage to defenders. By sinkholing or disabling the authorization host, security teams can effectively degrade every active deployment of the kit simultaneously, rather than addressing individual instances.
7Evolution of Phishing Tactics
The investigation originated from malicious campaigns targeting Japanese users in late 2025. The kits have since expanded to target organizations in Australia, India, and the United States. Attackers frequently impersonate postal, tax, and banking services to deceive victims. These operations demonstrate a highly professionalized, service-oriented approach to global cybercrime.
8Strategic Impact on Cybercrime
This disruption follows Microsoft's recent takedown of the EvilTokens service, which utilized AI in its attack chain. By dismantling the YAM Store and associated kits, Microsoft makes it significantly harder for criminals to acquire the tools and infrastructure necessary for large-scale fraud. Ongoing vigilance remains critical against these evolving, interconnected threats.