Microsoft disrupts phishing kits behind 1 billion scam messages
Microsoft says three phishing kits helped send more than one billion scam messages before a joint operation disrupted their developers and infrastructure.
Microsoft says it has helped disrupt three phishing kits linked to more than one billion phishing emails and SMS messages sent to over 75,000 organisations since January 2026. The operation targeted the infrastructure behind the scams, not just individual phishing domains.1
Three kits, one criminal marketplace
The kits are CoGUI, also known as NX or FA, Haozi, also known as Phoenix, and Iron Man System. Microsoft tracks the developers behind them as Storm-2990 and the marketplace that sold their tools and infrastructure as YAM Store, or Storm-3119.1
The kits offered templates that impersonated government, financial and logistics organisations. Microsoft says the ecosystem targeted organisations and consumers in Japan, the United States, Australia and India, while the kits themselves supported campaigns across more than 150 countries.12
How the operation worked
The criminal ecosystem combined phishing templates with access to compromised or fraudulent Microsoft and Google cloud environments. The operators used hijacked SharePoint and OneDrive storage to host campaigns, then sold accounts, licences and storage through an automated marketplace.1
The kits also used country filtering, fake CAPTCHA gates and Telegram alerts. Data entered into phishing pages was captured through WebSockets, allowing operators to monitor victims and control what the pages showed next.1
Microsoft says it worked with Health-ISAC, the Japan Cybercrime Control Center and private-sector partners including Cloudflare, Oracle, Proofpoint and Resecurity. The disruption followed a Microsoft investigation launched after malicious campaigns targeting people in Japan.12
Our opinion
The useful detail here is the infrastructure model. Phishing is often presented as a pile of disposable scam pages, but this takedown describes a commercial supply chain that sells templates, hosting and access to would-be criminals. Disrupting that layer should raise the cost of attacks, even if it cannot remove the demand for stolen credentials.
The scale Microsoft reports is also a reminder that the visible message is only the final step. YAM Store and the three kits made the campaigns repeatable; breaking that service economy is more significant than removing one more batch of URLs.1