Ethical Hacking News
Microsoft's recent disruption of three phishing kits linked to over 1 billion scam messages marks a significant victory in the ongoing battle against PhaaS platforms. The operation, carried out in collaboration with a coalition of private sector companies, highlights the need for robust cybersecurity measures and a vigilant approach to identifying and mitigating the risks associated with PhaaS platforms. The disruption underscores the importance of collaboration between governments, private sector companies, and cybersecurity experts in the fight against cybercrime.
Microsoft has disrupted three phishing kits linked to over 1 billion scam messages, marking a significant victory in the battle against PhaaS platforms. The disruption, carried out in collaboration with a coalition of private sector companies, highlights the need for robust cybersecurity measures. The three phishing kits, CoGUI, Haozi, and Iron Man System, have been used to target consumers, healthcare organizations, financial institutions, and businesses in over 150 countries. The disruption underscores the importance of collaboration between governments, private sector companies, and cybersecurity experts in the fight against cybercrime. The operation is a wake-up call for organizations worldwide, emphasizing the need for vigilance in identifying and mitigating the risks associated with PhaaS platforms.
Microsoft's recent announcement to disrupt three phishing kits linked to over 1 billion scam messages has sent shockwaves throughout the cybersecurity community, shedding light on the intricate and far-reaching nature of global cybercrime networks. The disruption, carried out in collaboration with a coalition of private sector companies, including Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, marks a significant victory in the ongoing battle against phishing-as-a-service (PhaaS) platforms.
At the heart of this operation lies a complex web of interconnected phishing kit operators, developers, and an illicit marketplace, codenamed YAM Store. YAM Store, described as a central hub in the operations, peddles tools and infrastructure using compromised or fraudulently obtained Microsoft or Google environments for large-scale phishing attacks. The Chinese-language cybercriminal ecosystem, which has been described as an interconnected network, has been linked to the sending of over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide.
The development comes after an investigation launched by Microsoft in late 2025, which was prompted by malicious messaging campaigns targeting people in Japan. The investigation led to the court-authorized operation, which aimed to disrupt the phishing kits and dismantle the cybercrime network. The kits in question, CoGUI, Haozi, and Iron Man System, have been observed to have overlapping capabilities and infrastructure, suggesting shared development origins, code reuse, or close collaboration among their Chinese-speaking developers.
CoGUI, the first of the three phishing kits to be disrupted, has been observed targeting Japanese organizations by impersonating well-known consumer and finance brands such as Amazon, PayPay, MyJCB, Apple, Orico, and Rakuten. The kit, which has been in operation since at least October 2024, has spawned two closely related variants named CoAceV and CoFish_Ws. In total, around 17,000 unique domains have been used by the three kits.
The disruption of these phishing kits marks a significant victory in the ongoing battle against PhaaS platforms. The kits, which have been linked to the sending of over one billion phishing emails and SMS messages, have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.
The use of automation to identify expired environment or organization names, profile cloud-enabled organizations, and discover Microsoft 365 tenants, is notable in the tradecraft employed by the kits. The reconnaissance phase occurs anonymously through Tor infrastructure. Take over viable environments and manage them using app-only administrative panels implemented in PHP, Java/Spring, and Cloudflare Workers. Establish presence within the compromised tenant, grant itself broad Microsoft Graph permissions and full control over the SharePoint API, and abuse the tenant's SharePoint and OneDrive as bulk hosting and turn the hijacked storage into a sellable product.
The development comes as a wake-up call for organizations worldwide, highlighting the need for robust cybersecurity measures and a vigilant approach to identifying and mitigating the risks associated with PhaaS platforms. Microsoft's disruption of these phishing kits marks a significant step in the ongoing effort to combat global cybercrime networks and protect the rights of individuals and businesses worldwide.
The disruption also underscores the importance of collaboration between governments, private sector companies, and cybersecurity experts in the fight against cybercrime. The coalition of companies involved in the operation, including Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, has demonstrated the value of collaboration in disrupting complex cybercrime networks and protecting the global community from the risks associated with PhaaS platforms.
In conclusion, the disruption of the three phishing kits linked to over 1 billion scam messages marks a significant victory in the ongoing battle against PhaaS platforms. The operation, carried out in collaboration with a coalition of private sector companies, highlights the need for robust cybersecurity measures and a vigilant approach to identifying and mitigating the risks associated with PhaaS platforms. The development serves as a wake-up call for organizations worldwide, emphasizing the importance of collaboration and cooperation in the fight against global cybercrime networks.
Microsoft's recent disruption of three phishing kits linked to over 1 billion scam messages marks a significant victory in the ongoing battle against PhaaS platforms. The operation, carried out in collaboration with a coalition of private sector companies, highlights the need for robust cybersecurity measures and a vigilant approach to identifying and mitigating the risks associated with PhaaS platforms. The disruption underscores the importance of collaboration between governments, private sector companies, and cybersecurity experts in the fight against cybercrime.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Complex-Web-of-Cybercrime-Microsofts-Disruptive-Takedown-of-a-Global-Phishing-Network-ehn.shtml
https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html
Published: Wed Oct 14 15:10:45 2026 by llama3.2 3B Q4_K_M
