Microsoft has disrupted infrastructure supporting three Chinese-language phishing kits that the company says enabled more than one billion malicious messages impersonating over 75,000 organisations in more than 150 countries since January 2026.
The technology company said it worked with Japan’s National Police Agency and healthcare cybersecurity organisation Health-ISAC to obtain a US court order allowing it to seize and redirect domains linked to the phishing kits Haozi, CoGUI and Iron Man.
Microsoft said the tools were used by cybercriminals to steal login credentials, personal information, banking data and other account details. The kits also allowed less technically skilled criminals to launch large-scale phishing campaigns using pre-built websites, messages and fake login pages.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Court Order Targets Haozi, CoGUI and Iron Man Infrastructure
Microsoft said the three phishing kits were developed by Chinese-speaking threat actors. Despite being sold under different names and through separate Telegram-based channels, the company said the tools displayed similar capabilities and functionality.
The infrastructure supported campaigns targeting consumers, healthcare organisations, financial institutions and other businesses. According to Microsoft, more than 75,000 organisations in over 150 countries were impersonated through the malicious messages.
The operators of the phishing ecosystem reportedly earned tens of millions of dollars by selling access to the tools and services used in the campaigns.
The disruption follows an investigation launched by Microsoft late last year after the company was alerted to malicious messaging campaigns targeting people in Japan.
Ready-Made Phishing Pages Lowered Barrier for Cybercriminals
Iron Man operates as a phishing-kit-as-a-service platform and offers more than 2,300 pre-built lure pages impersonating postal companies, traffic fine offices, tax agencies, banks and telecommunications providers.
CoGUI similarly provides ready-made websites and messages designed to mimic trusted brands, financial institutions, government agencies and other organisations.
Microsoft said such tools have been used in common scam formats, including fake toll payment messages, delivery alerts, bank notifications and tax-related warnings.
Steven Masada, associate general counsel for Microsoft’s Digital Crimes Unit, said the details of these scams may vary, but their objective remains the same: persuading people to click links, disclose personal information or make payments.
The company said the availability of packaged phishing infrastructure had reduced the technical skills needed to carry out large-scale fraud campaigns.
Underground Marketplace Used Cryptocurrency Payments
Microsoft said all three phishing kits were sold through the YAM Store, an underground marketplace that the company tracks as Storm-3119.
The marketplace and affiliated phishing-kit businesses accepted cryptocurrency payments, including USDT and Ethereum.
Microsoft said the use of cryptocurrency added another layer of concealment to the operators’ activities.
The company said the scale of the ecosystem showed how readily available criminal infrastructure can allow less skilled cybercriminals to target organisations at scale and contribute to fraud losses.
The court-backed disruption is intended to weaken the infrastructure used by the phishing services by taking control of associated domains and redirecting traffic away from the criminal network.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
