Global Takedown Hits Network Behind 1 Billion Phishing Messages

Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem

In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally.

Microsoft, Health-ISAC and partners take down popular phishing kit services

The three marketplaces helped hackers impersonate major businesses and governments. Microsoft now controls the markets’ domain names.

Global takedown hits network behind 1 billion phishing messages

A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide.

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages | #cybercrime | #infosec - National Cyber Security Consulting

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits […] Thank you for subscribing to our RSS feed!

Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man, a widely used Chinese phishing market.