Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
Microsoft, along with Health-ISAC and the Japan Cybercrime Control Center, announced the disruption of three phishing kits, CoGUI, Haozi, and Iron Man System. Since January 2026, these kits have been responsible for sending over one billion phishing emails and SMS messages to more than 75,000 organizations worldwide. This operation was launched after Microsoft received a notification of malicious messaging campaigns targeting individuals in Japan.
The investigation revealed that the kits overlap in capabilities and infrastructure, suggesting shared development origins or close collaboration among their Chinese-speaking developers.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
