hacker-news Oct 14, 2026 · Crawled Oct 15, 2026

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

1 Malware

AI Summary

Microsoft, in collaboration with Health-ISAC, JC3, and private sector partners, disrupted three phishing kits—CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System—linked to over 1 billion phishing messages targeting organizations in more than 150 countries. These kits were sold via an underground marketplace called YAM Store, tracked as Storm-3119, and developed by a group tracked as Storm-2990. The phishing kits enabled large-scale credential theft and financial fraud by impersonating legitimate brands in sectors such as finance, healthcare, and logistics. The operation revealed shared infrastructure and code among the kits, indicating close collaboration or common origins among Chinese-speaking developers.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Phoenix →

MITRE ATT&CK TTPs 8 techniques

T1027 Obfuscated Files or Information · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1090 Proxy · Command And Control T1133 External Remote Services · Persistence T1480 Execution Guardrails · Defense Evasion T1566 Phishing · Initial Access