Cybersecurity
Microsoft disrupts three phishing kits
Microsoft, Health-ISAC and Japan's JC3 said they disrupted three phishing kits after an investigation that began in late 2025 and linked them to a large phishing operation.
- Microsoft, Health-ISAC and Japan Cybercrime Control Center said they disrupted CoGUI, Haozi and Iron Man System.
- Microsoft said the kits had been used since January 2026 to send more than one billion phishing emails and SMS messages.
- Microsoft said it opened the case in late 2025 after being told about malicious messaging campaigns aimed at people in Japan.
- Health-ISAC said the messages reached consumers, healthcare organisations, financial institutions and other businesses in more than 150 countries.
- Microsoft said it tracked the marketplace as Storm-3119 and the kit developers as Storm-2990.
Microsoft, Health-ISAC and Japan Cybercrime Control Center said they had disrupted CoGUI, Haozi and Iron Man System. Microsoft said the kits had been used since January 2026 to send more than one billion phishing emails and SMS messages to more than 75,000 organisations.
Microsoft said it opened the investigation in late 2025 after receiving notice of malicious messaging campaigns aimed at people in Japan. It said it tracked the marketplace as Storm-3119 and the kit developers as Storm-2990.
Microsoft said the operation used compromised or fraudulently obtained Microsoft or Google environments and a marketplace called YAM Store. Health-ISAC said the messages reached consumers, healthcare organisations, financial institutions and other businesses in more than 150 countries.
Proofpoint said CoGUI had targeted Japanese organisations and had been active since at least October 2024, while TRM Labs said Iron Man System was increasingly replacing it by mid-2026. Resecurity said it had bought a kit licence for analysis and found 2,360 lure packages and 911 admin-panel builds.
Named in this story
People
- Steven Masada
- commented for Microsoft on the disruption
Companies
- Microsoft
- announced the disruption and led the investigation
- Cloudflare
- was named in the coalition supporting the operation
- Oracle
- was named in the coalition supporting the operation
- Proofpoint
- described CoGUI in May 2025
- TRM Labs
- said Iron Man System was replacing CoGUI by mid-2026
- Resecurity
- bought a licence and analysed the kit in a lab
Organisations
- Health-ISAC
- co-announced the disruption
- Japan Cybercrime Control Center (JC3)
- joined the disruption effort
- Microsoft Threat Intelligence
- said the kits had enabled over one billion messages
- Microsoft Digital Crimes Unit
- said the kits had enabled over one billion messages
- YAM Store
- was an illicit marketplace used to advertise the kits
- Storm-3119
- was Microsoft's label for the marketplace
- Storm-2990
- was Microsoft's label for the kit developers
Products and systems
- CoGUI
- was one of the disrupted phishing kits
- Haozi
- was one of the disrupted phishing kits
- Iron Man System
- was one of the disrupted phishing kits
How the source tells it
The article was mostly a straight security report, but it stressed scale and organised-crime structure to heighten the threat.
- urgency large totals and country counts were used to stress the reach of the campaign
- threat framing the operation was cast as an interconnected underground criminal network