Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System.

"Since January 2026, the threat actors behind these kits have been responsible for facilitating the sending of over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide," the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit said.

The court-authorized operation is the result of an investigation that Microsoft launched in late 2025 after it was notified of malicious messaging campaigns targeting people in Japan. The

The Chinese-language cybercriminal ecosystem has been described as an interconnected network of phishing kit operators, developers, and an illicit marketplace and initial access broker (IAB) codenamed YAM Store that peddles tools and infrastructure using compromised or fraudulently obtained Microsoft or Google environments for large-scale phishing attacks.

Microsoft is tracking the underground marketplace as Storm-3119 and the developers behind all three phishing kits as Storm-2990. Evidence indicates that the three kits overlap in capabilities and infrastructure, suggesting shared development origins, code reuse, or close collaboration among their Chinese-speaking developers.

As is the case with any phishing-as-a-service (PhaaS or PaaS) platform, the end goal is to provide phishing templates impersonating legitimate brands and organizations spanning government, financial, and logistics sectors worldwide, and enable high-volume phishing and credential stealing operations.

"These messages have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators," Health-ISAC said .

Source link