Researchers uncovered a commercial phishing-kit-as-a-service called “Iron Man System” that lets criminals quickly deploy fake brand pages (postal/courier, toll fines, tax, banks, telecoms, loyalty programs) to steal victim data. The operation appears active and professionally maintained, with thousands of ready-made templates and a vendor-controlled licensing backend that buyers’ deployments must contact to work. Microsoft and partners reportedly disrupted parts of the supporting infrastructure.
The Iron Man System is a phishing-kit-as-a-service sold to criminals rather than a single targeted campaign. Buyers receive a self-hosted package containing thousands of pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms, and loyalty programs. These pages are designed to look like legitimate portals and to capture whatever data a victim submits, including payment details and personal information.
Resecurity found 2,360 phishing templates spread across 130 countries, suggesting the kit is used broadly rather than against a narrow set of targets. A lab deployment showed a management panel, version 6.3.1, with a license countdown and a list of active lure instances impersonating organizations such as a European parking-fine operator and a Japanese payment service.
The kit's effectiveness comes from its scale and professionalism rather than technical novelty. Because templates mimic trusted entities like government agencies, banks, and courier services, victims are primed to respond quickly to urgent-sounding notices such as fine payments or account verification requests. The operation also appears to be actively maintained, with new catalog additions indicating ongoing sales and updates, meaning lure pages can stay current and convincing over time.
A notable structural detail is that deployments rely on vendor-operated infrastructure for licensing and authorization. This centralized dependency is what allowed researchers and partners to identify and disrupt supporting infrastructure, even though the kit itself is distributed to many independent buyers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a commercially sold phishing-kit-as-a-service that lets buyers deploy pre-built lure pages impersonating postal services, tax agencies, banks, telecoms, and other trusted organizations to steal victim data.
Resecurity reported finding 2,360 phishing templates across 130 countries, describing the operation as active and frequently updated.
Yes. Because the kit depends on vendor-operated licensing infrastructure, taking down or sinkholing those backend services can potentially disable many buyer deployments at once.
Simulated lures included fake parking/traffic-fine payment portals and lookalike payment-service login pages, both designed to capture payment details and personal information.
You get a popup: “Parking fine payment required, pay online to avoid penalty.” Looks like your local traffic authority… but it isn’t. Behind that page could be the “Iron Man System”, a phishing kit with 2,360 templates across 130 countries, churning out fake portals for parking fines, tax, banks, and telecoms to grab whatever you type. One click takes you to a lookalike payment page: maybe a Japanese payment service, maybe your bank. The layout looks right, but the URL is off and it asks for way too much personal and payment data. If you get an unexpected fine or “verify your account to pay” message, don’t click. Close it, then go to the official site yourself by typing the address in the browser.
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
