Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem

Storm-2990 operated a sophisticated, commoditized phishing-kit ecosystem that made credential theft scalable and accessible to a wide range of threat actors, resulting in over 1 billion malicious messages sent to 75,000+ organizations. The root failure is a combination of insufficient user security awareness — employees clicking phishing links and surrendering credentials — and weak account protections that allowed stolen credentials to be immediately weaponized. Phishing-as-a-service platforms like CoGUI dramatically lower the barrier to entry for attackers, meaning even unsophisticated criminals can launch high-volume, convincing campaigns. This matters because compromised credentials are a primary entry point for ransomware, business email compromise, and data breaches that can devastate organizations financially and reputationally.