In a coordinated effort, **Microsoft**, **Health-ISAC**, and the **Japan Cybercrime Control Center (JC3)**, alongside private sector partners like **Resecurity**, **Cloudflare**, **Oracle**, **Proofpoint**, and **TRM Labs**, have announced the successful disruption of three major phishing kits: **CoGUI** (also known as NX or FA), **Haozi** (also known as Phoenix), and **Iron Man System**. ### Unmasking a Billion-Email Campaign According to **Microsoft Threat Intelligence** and the **Microsoft Digital Crimes Unit**, the threat actors behind these kits have been instrumental in sending over one billion phishing emails and SMS messages, impacting more than 75,000 organizations globally since January 2026. The court-authorized operation stemmed from a **Microsoft** investigation initiated in late 2025, following reports of malicious messaging campaigns targeting individuals in Japan. ### The Chinese Cybercriminal Ecosystem: YAM Store and Storm-3119 This sophisticated Chinese-language cybercriminal ecosystem operates as an interconnected network. It comprises phishing kit operators, developers, and an illicit marketplace and initial access broker (IAB) known as **YAM Store**. This marketplace facilitated the sale of tools and infrastructure, often leveraging compromised or fraudulently obtained **Microsoft** or **Google** cloud environments for large-scale phishing attacks. **Microsoft** tracks this underground marketplace as **Storm-3119**, and the developers behind the three disrupted phishing kits as **Storm-2990**. Evidence suggests significant overlap in capabilities and infrastructure among the kits, indicating shared development, code reuse, or close collaboration among their Chinese-speaking creators. ### Phishing-as-a-Service (PhaaS) in Action Like other PhaaS platforms, these kits provided phishing templates impersonating legitimate brands and organizations across government, financial, and logistics sectors globally. Their primary goal was to enable high-volume phishing and credential-stealing operations. **Health-ISAC** reported that these malicious messages targeted consumers, healthcare organizations, financial institutions, and other businesses in over 150 countries, generating tens of millions of dollars for their operators. Threat actors purchased these kits and access to compromised **Microsoft** or **Google** cloud environments to target organizations in healthcare, financial services, wholesale distribution, and IT sectors in Japan, the U.S., Australia, and India. "These phishing kits have been advertised through **YAM Store**, first **CoGUI** and **Haozi**, followed by **Iron Man System** starting in June 2026," **Microsoft** stated. "**YAM Store** and affiliated phishing kit companies accepted payments through cryptocurrency, including **USDT** and **Ethereum**, adding another layer to conceal illicit activity." **YAM Store** played a central role, advertising legitimate infrastructure associated with legitimate, expired, or previously used organizations that other cybercriminals could purchase for their attacks.  ### Storm-3119's Advanced Tradecraft Notable aspects of **Storm-3119**'s operational tradecraft include: * **Automated Reconnaissance:** Utilizing automation to identify expired environments or organization names, profile cloud-enabled organizations, and discover **Microsoft 365** tenants, with reconnaissance conducted anonymously via **Tor** infrastructure. * **Environment Takeover:** Taking over viable environments and managing them using app-only administrative panels implemented in **PHP**, **Java/Spring**, and **Cloudflare Workers**. * **Persistent Presence:** Establishing presence within compromised tenants, granting broad **Microsoft Graph** permissions and full control over the **SharePoint API**, then abusing the tenant's **SharePoint** and **OneDrive** for bulk hosting and selling hijacked storage. * **Dedicated Infrastructure:** Maintaining dedicated infrastructure to support and oversee phishing operations for their customers. * **Reselling Illicit Goods:** Reselling hijacked accounts, licenses, and storage through an automated storefront. * **Phishing Kit Sales:** Selling phishing kits, tracked as **Storm-2990**, to facilitate the theft of sign-in credentials and financial data. ### The Evolution of Phishing Kits: CoGUI to Iron Man System **CoGUI**, as detailed by **Proofpoint** in May 2025, has been observed targeting Japanese organizations by impersonating well-known consumer and finance brands like **Amazon**, **PayPay**, **MyJCB**, **Apple**, **Orico**, and **Rakuten**. This kit has been active in real-world campaigns since at least October 2024. **Proofpoint** also noted that **CoGUI** spawned two closely related variants, **CoAceV** and **CoFish_Ws**. Collectively, these three kits have used approximately 17,000 unique domains. By mid-2026, **Iron Man System** was increasingly replacing **CoGUI**, according to **TRM Labs**. The **Iron Man System** boasts over 2,335 phishing templates tailored to impersonate trusted brands and organizations across 139 countries, including Australia, Japan, India, and the U.S. It also incorporates features to restrict access to phishing content to users from specific countries. **Resecurity**, after purchasing and deploying the kit in an isolated lab, reported that it supports 2,360 distinct phishing lure packages impersonating postal, tax, banking, telecom, and loyalty-program brands across 130 countries and regions. **Resecurity** also located a self-hosted Git and container-registry server containing 911 builds for the admin panel from October 2025 through June 2026. The cybersecurity firm further discovered that the kit requires regular contact with the vendor's licensing server to function. This dependency is a boon for defenders, as disabling or sinkholing the authorization host would degrade every active deployment, not just those under investigation. ### Advanced Evasion Techniques These phishing kits employ advanced evasion techniques, including fake **CAPTCHA** gates to filter out automated browsing sessions, IP-based blocklists and allowlists, and **Telegram**-based alerts that notify operators when a victim interacts with a phishing lure. Sensitive information entered on the phishing sites is captured using a **WebSocket**, allowing operators to monitor progress in real-time and control the victim's subsequent interactions. The stolen financial information is then used by downstream actors for fraudulent purchases of high-end goods or illicit transactions on legitimate financial platforms. "What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world," said **Steven Masada**, associate general counsel and general manager of **Microsoft's Digital Crimes Unit**. "**YAM Store**, **CoGUI**, and **Iron Man** are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools, and infrastructure they rely on. The scam message is often the only part victims see. The businesses behind it are what make it possible." This development follows less than a month after **Microsoft** announced the takedown of the **EvilTokens** device code phishing service, which reportedly used artificial intelligence (AI) "at every step of the attack chain."