[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEevZPsuEGIqEZpLVxbj43Gapkl1qlTNt57PhzvLpXTU":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d6edbdb8-aa3b-407d-bd3d-bf56ceb4034f","Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem","microsoft-and-partners-disrupt-vast-chinese-language-phishing-kit-ecosystem-987ce0","In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally. The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.","Microsoft, alongside Japanese authorities and cybersecurity partners, has dismantled a large ecosystem of Chinese-language phishing kits and services. These tools, operated by threat cluster Storm-2990, were used to send over 1 billion malicious messages to more than 75,000 organizations globally, primarily targeting Microsoft customers. The operation disrupted services like YAM Store, CoGUI, and Iron Man, seizing domains and disabling thousands of accounts to hinder credential theft and financial fraud.","Microsoft and partners disrupt Chinese-language phishing kit ecosystem, stopping over 1 billion messages.","https:\u002F\u002Fcyberscoop.com\u002Fmicrosoft-disrupts-chinese-language-phishing-kit-ecosystem\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F03\u002FGettyImages-1467743069.jpg","2026-10-14T13:00:00+00:00","2026-10-14T14:00:18.4009+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Storm-2990","threat_actor",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"YAM Store","product",{"name":27,"type":25},"CoGUI",{"name":29,"type":25},"Iron Man","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[],[21,24,27],{"controls":56,"vendors":139},[57,86,113],{"slug":58,"name":59,"problem":60,"products":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":87,"name":88,"problem":89,"products":90},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[91,99,105],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":100,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":100,"url":103,"description":104},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,123,131],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":119,"product_name":120,"url":121,"description":122},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[140],{"slug":141,"name":21,"logo_path":142,"roles":143},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":161},"billion-message-phishing-ecosystem-targeting-microsoft-users-dismantled","Billion-Message Phishing Ecosystem Targeting Microsoft Users Dismantled","Storm-2990 operated a sophisticated, commoditized phishing-kit ecosystem that made credential theft scalable and accessible to a wide range of threat actors, resulting in over 1 billion malicious messages sent to 75,000+ organizations. The root failure is a combination of insufficient user security awareness — employees clicking phishing links and surrendering credentials — and weak account protections that allowed stolen credentials to be immediately weaponized. Phishing-as-a-service platforms like CoGUI dramatically lower the barrier to entry for attackers, meaning even unsophisticated criminals can launch high-volume, convincing campaigns. This matters because compromised credentials are a primary entry point for ransomware, business email compromise, and data breaches that can devastate organizations financially and reputationally.",[150,151,152,153,154,155,156,157,158,159,160],"CIS Control 9 – Email and Web Browser Protections","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST CSF PR.AT-1 – Security Awareness Training","NIST CSF DE.CM-1 – Network Monitoring and Anomaly Detection","NIST AC-2 – Account Management","NIST SI-8 – Spam Protection","GDPR Article 32 – Security of Processing (credential protection obligations)","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1078 – Valid Accounts",{}]