Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery, healthcare, finance) to steal logins and payment card data from organizations across multiple sectors.
Microsoft identified a Chinese-language phishing-as-a-service ecosystem that sold ready-made phishing kits and cloud infrastructure through an underground marketplace. Criminals who bought access did not need technical skills of their own. They received templates that impersonated trusted brands and agencies, including government traffic and parking authorities, logistics providers, healthcare programs, and financial institutions. The kits were used to send over one billion phishing emails and SMS messages, targeting more than 75 thousand organizations worldwide.
A key part of the operation was making the phishing infrastructure look legitimate. Actors used compromised or fraudulently obtained cloud environments so that lookalike sites and sending domains resembled normal business traffic rather than obvious malicious infrastructure.
The lures worked because they matched everyday situations employees expect to encounter: an unpaid parking fine, a delivery problem, or a routine account security check. Each scenario created urgency and offered a quick, official-looking way to resolve it. The kits also supported real-time victim monitoring through Telegram, letting operators watch as targets entered credentials and verification codes and intervene on the spot.
This combination of believable pretexts, legitimate-looking infrastructure, and live monitoring made it harder for both automated defenses and cautious individuals to catch the deception before damage was done.
Organizations can reduce exposure by training staff to verify unexpected payment, delivery, or security notices through known official channels instead of clicking embedded links. Employees should be reminded that legitimate re-authentication requests rarely arrive as urgent unsolicited messages, and that one-time codes should never be entered into a page reached from an unexpected link or text.
Because attackers can make fraudulent pages look convincing and may be actively monitoring victim input, defenses should rely on consistent verification habits rather than visual inspection alone. Simulation exercises that mirror these pretexts, traffic fines, delivery issues, and account re-authentication notices, can help reinforce these habits across finance, procurement, operations, and general staff audiences most likely to receive such lures.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an underground model where developers sell ready-made phishing kits and legitimate-looking cloud infrastructure to criminals, letting them launch large-scale email and SMS phishing without building their own tools.
Microsoft reported that the kits enabled over one billion phishing emails and SMS messages targeting over 75 thousand organizations worldwide.
The kits impersonated trusted brands and agencies including government traffic and parking authorities, logistics companies like Amazon and Australia Post, healthcare programs like Medicare, and financial service providers.
The phishing kits included Telegram bot configurations that allowed operators to watch victims enter credentials and verification codes live, enabling interactive phishing where the attacker reacted as the victim typed.
Since January, one phishing network pushed over one billion fake emails and texts, many look like real government or Amazon messages. You get a text: 'Traffic/parking authority notice: outstanding fine, pay now via the official portal.' The link opens a very polished payment page, hosted on Microsoft or Google cloud, asking for your card details immediately. Or an email: 'Delivery alert: there’s an issue with your Amazon shipment, confirm details to proceed.' The lookalike site steals your Amazon login and card, and a Telegram bot pings criminals in real time when you type a one-time code. If any 'official' fine, delivery, or re-authentication message is unexpected, don’t click. Close it, then go to the real site or app yourself and check from there.
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
