Phoenix

Microsoft, in collaboration with Health-ISAC, JC3, and private sector partners, disrupted three phishing kits—CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System—linked to over 1 billion phishing messages targeting organizations in more than 150 countries. These kits were sold via an underground marketplace called YAM Store, tracked as Storm-3119, and developed by a group tracked as Storm-2990. The phishing kits enabled large-scale credential theft and financial fraud by impersonating legitimate brands in sectors such as finance, healthcare, and logistics. The operation revealed shared infrastructure and code among the kits, indicating close collaboration or common origins among Chinese-speaking developers.