Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft disrupts 3 phishing kits responsible for over 1 billion scam messages.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Microsoft, in collaboration with Health-ISAC, JC3, and several private sector companies, has successfully disrupted three sophisticated phishing kits: CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. These kits have been instrumental in sending over one billion scam messages since January 2026, targeting individuals and organizations globally.
The lesson from this incident
Full lessonThree sophisticated phishing kits — CoGUI, Haozi, and Iron Man System — collectively sent over one billion scam messages since January 2026, exploiting end-user trust and lack of phishing awareness at massive scale. The root issue is that phishing infrastructure can operate largely unimpeded until coordinated industry takedowns occur, meaning organizations cannot rely solely on reactive disruption efforts. This case highlights how phishing kits have become commoditized, lowering the barrier for threat actors to launch high-volume, convincing campaigns. Without robust user training, technical email controls, and threat intelligence sharing, organizations remain highly vulnerable between disruption events.
What helps against this
How we list vendors
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.