"Since January 2026, the threat actors behind these kits have been responsible for facilitating the sending of over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide," Microsoft Threat Intelligence and Microsoft Digital Crimes Unit said — a blunt tally that captures both scale and reach.
The three phishing kits: CoGUI, Haozi (Phoenix), and Iron Man System
Microsoft, Health-ISAC, the Japan Cybercrime Control Center (JC3) and a coalition of private companies including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs announced a court-authorized disruption of three linked phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. Proofpoint previously documented CoGUI targeting Japanese organizations, and TRM Labs reported that by mid-2026 CoGUI was increasingly being supplanted by Iron Man System.
Each kit packages phishing templates that impersonate legitimate brands across government, financial, logistics and consumer sectors. Resecurity found Iron Man System supports 2,360 distinct phishing lure packages across 130 countries and regions; TRM Labs reported Iron Man System contains more than 2,335 templates for 139 countries. Across the three kits, about 17,000 unique domains have been used in campaigns.
Storm-3119, Storm-2990 and the YAM Store marketplace
Microsoft is tracking the underground marketplace that advertised these kits as Storm-3119 and the developers behind the kits as Storm-2990. The illicit marketplace — described in source material as YAM Store — advertised legitimate infrastructure tied to expired or previously used organizations and sold access to compromised or fraudulently obtained Microsoft and Google environments. Microsoft noted YAM Store and affiliated sellers accepted cryptocurrency payments including USDT and Ethereum.
Investigators say YAM Store occupied a central place in operations, offering automated storefronts where criminals could buy hijacked accounts, licenses and storage as well as the phishing kits themselves.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildStorm-3119 tradecraft: how the ecosystem operated
The disruption report catalogs a layered, automated tradecraft. Reconnaissance used Tor to anonymously discover expired environment names and cloud-enabled organizations, then identify viable Microsoft 365 tenants. Operators took over tenants and managed them via app-only administrative panels implemented in PHP, Java/Spring and Cloudflare Workers.
Once inside, the actors granted themselves broad Microsoft Graph permissions, full control over the SharePoint API, and repurposed SharePoint and OneDrive as bulk hosting for phishing content. They maintained dedicated infrastructure to support customer operations, resold resources through automated storefronts, and sold the phishing kits tracked as Storm-2990 to facilitate credential theft.
Operational evasion included fake CAPTCHA gates to block automated analysis, IP-based allow/block lists, Telegram-based alerts to notify operators when victims engaged, and real-time capture of entered data via WebSocket so operators could tailor what victims saw next. Stolen financial information was then used by downstream actors to make fraudulent purchases or transactions.
Scale, targets, and financial impact
Health-ISAC described the messaging as targeting consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries and generating "tens of millions of dollars" for operators. Microsoft’s investigation, launched in late 2025 after it was notified of malicious messaging campaigns targeting people in Japan, links these operations to campaigns that have been active in varied markets including Japan, the U.S., Australia and India.
Notable operational details from third-party analysis include Resecurity locating a self-hosted Git and container-registry server containing 911 builds for an admin panel spanning October 2025 through June 2026, and Proofpoint’s earlier reporting that CoGUI had been used in real-world campaigns since at least October 2024.
What this means for technologists, policymakers, and affected organizations
- Technologists and security teams: monitor anomalous app-only admin activity, Microsoft Graph permission changes, and unexpected use of SharePoint/OneDrive as hosting. Resecurity noted the kits require regular contact with a vendor licensing server, "a dependency that favors defenders, since disabling or sinkholing the authorization host would degrade every active deployment."
- Policymakers and regulators: the cross-border reach, cryptocurrency payments (USDT, Ethereum), and automated resale of hijacked cloud assets underline challenges for international cooperation and enforcement against marketplaces such as YAM Store.
- Affected enterprises and procurement leaders: beware reused or expired organization names being advertised as legitimate infrastructure; attackers purchased compromised or fraudulently obtained Microsoft or Google environments to stage high-volume campaigns.
Microsoft framed the disruption as part of a continuing campaign to remove the infrastructure that enables large-scale phishing. "YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on," Steven Masada, associate general counsel and general manager of Microsoft’s Digital Crimes Unit, said. The action follows, by Microsoft’s account, a separate takedown less than a month earlier of the EvilTokens device code phishing service — a campaign Microsoft said used AI "at every step of the attack chain."
The operation strikes at the marketplace and the kits that turned stolen cloud assets into a sellable service. Whether the disruption will sharply reduce the billion-message scale of these campaigns will depend on how quickly buyers and sellers shift to other vendors or infrastructure — and on defenders' ability to exploit the kits' single points of failure, like the licensing servers Resecurity identified.
Source: The Hacker News — Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
