Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

What happened

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System .

the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit said .

The court-authorized operation is the result of an investigation that Microsoft launched in late 2025 after it was notified of malicious messaging campaigns targeting people in Japan.

What changed

Some of the notable aspects of Storm-3119's tradecraft are listed below - CoGUI, as detailed by Proofpoint in May 2025, has been observed targeting Japanese organizations by impersonating well-known consumer and finance brands such as Amazon, PayPay, MyJCB, Apple, Orico, and Rakuten.

The kit is said to have been used in real-world campaigns since at least October 2024.

The cybersecurity company also found that the kit requires regular contact with the vendor's licensing server to function, Other advanced evasion techniques employed by the kits include fake CAPTCHA gates to filter out automated browsing sessions, IP-based block list and allow list, and Telegram-based alerts that notify the kit operator when a victim acts on a phishing lure.

Who is affected

The The Chinese-language cybercriminal ecosystem has been described as an interconnected network of phishing kit operators, developers, and an illicit marketplace and initial access broker (IAB) codenamed YAM Store that peddles tools and infrastructure using compromised or fraudulently obtained Microsoft or Google environments for large-scale phishing attacks.

As is the case with any phishing-as-a-service (PhaaS or PaaS) platform, the end goal is to provide phishing templates impersonating legitimate brands and organizations spanning government, financial, and logistics sectors worldwide, and enable high-volume phishing and credential stealing operations.

Why it matters

Threat actors are said to have purchased these phishing kits, along with access to compromised or fraudulent Microsoft or Google cloud environments, to target organizations across the healthcare, financial services, wholesale distribution, and information technology (IT) sectors in Japan, the U.S., Australia, and India.

YAM Store also occupies a central place in the operations, as it advertises legitimate infrastructure associated with legitimate, expired, or previously used organizations that other cybercriminals can purchase to attack their targets.

Technical details

In compromised Microsoft environments, the operators used stolen application credentials to manage accounts and licenses, and abused SharePoint and OneDrive storage for hosting.

Microsoft said the phishing platforms delivered over 750 million messages targeting Microsoft 365 customers, many using device-code phishing to obtain authentication tokens.

The activity was focused on stealing credentials and payment data by impersonating well-known Japanese companies or international organizations.

Response

Resecurity, which purchased a license and deployed the kit in an isolated lab, said it supports 2,360 distinct phishing lure packages impersonating postal, tax, banking, telecom and loyalty-programme brands across 130 countries and regions.

Following an investigation initiated by Microsoft and Japan’s National Police Agency (NPA) into a wave of fraudulent activity, was discovered, with tools and services for phishing campaigns.

What security teams should do

The Iron Man System features more than 2,335 phishing templates that are tailored to impersonate trusted brands and organizations across 139 countries, including Australia, Japan, India, and the U.S., while taking steps to restrict access to phishing content to only users from specific countries.

The sensitive information entered on the phishing site is captured using a WebSocket, allowing the operators to monitor their progress in real-time and decide what their targets see next.

What remains unknown

However, the victim count remains unknown.

Exact membership count is unknown, and the ShinyHunters name is best understood as a brand used by a fluid network of criminal affiliates rather than a fixed roster of individuals.

Attribution

The Hacker News: Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System .

BleepingComputer: A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide.

BleepingComputer: A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.

The Hacker News: Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.

What to watch next

Watch for additional victim details, indicators of compromise and follow-on exploitation reports.

Watch for revised vendor guidance, fixed versions and mitigation updates.