Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
-
Microsoft, working alongside Health-ISAC, the Japan Cybercrime Control Center (JC3), and a coalition of private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, has announced the disruption of three phishing kits. The kits are tracked as CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System.
According to the announcement, the threat actors behind these kits have been responsible for a massive volume of scam messages since January 2026 — collectively linked to over 1 billion fraudulent messages.
Key details from the disclosure:
- Three phishing kits disrupted: CoGUI (aka NX / FA), Haozi (aka Phoenix), and Iron Man System
- Operation involved Microsoft, Health-ISAC, JC3, and private partners Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs
- The actors behind these kits have driven scam message campaigns since January 2026
- The kits are tied to more than 1 billion scam messages
The disruption highlights the ongoing value of cross-industry collaboration between technology vendors, threat intelligence firms, and regional cybercrime authorities in dismantling phishing infrastructure at scale.
Source: The Hacker News
Has your organization seen any activity tied to these phishing kits, and what detection or mitigation steps are you taking?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login