Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and financial data, often using evasion tricks like fake CAPTCHA pages and IP filtering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If you got a fake Amazon or Apple email this year, odds are it came from a kit called CoGUI, Haozi, or Iron Man System, part of over one billion phishing lures. Here’s the trick: the email or SMS says, ‘Action required, verify your account,’ you click, hit a fake CAPTCHA, then land on a perfect-looking login page for Amazon or your bank that’s actually hosted on some random domain. Aha moment: that extra CAPTCHA or region check isn’t for your security, it’s for theirs. Kits like Iron Man System use fake CAPTCHA gates and IP filters to dodge scanners while streaming your keystrokes to a Telegram panel in real time. If any email or text pushes you to 'verify' by clicking a link, don’t. Close it, and go to the site yourself from a bookmark or by typing the address in.
Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
