[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0_8xQMIDFdH-0Si61Xb_3NsOGAtjOqBi9R_-_CjcCrU":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ee5d4db6-6d6b-45e8-8fd7-0808a5c3471d","Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages","microsoft-disrupts-3-phishing-kits-linked-to-over-1-billion-scam-messages-fbe33b","Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for","Microsoft, in collaboration with Health-ISAC, JC3, and several private sector companies, has successfully disrupted three sophisticated phishing kits: CoGUI (NX\u002FFA), Haozi (Phoenix), and Iron Man System. These kits have been instrumental in sending over one billion scam messages since January 2026, targeting individuals and organizations globally.","Microsoft disrupts 3 phishing kits responsible for over 1 billion scam messages.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fmicrosoft-disrupts-3-phishing-kits.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhtmZA0sGFnGRVBoPOHXGNOr-Q1MpdbCUNVrfxBTV6z_URgCka1DOH4xcc_WuismhU3W1BEiostTKZetIhtrFyXrInKdz_jqK6Dtia5TDOqRiu4rkktKmF2Iz1br28coCyU3c5td-yrINUgjYIdwG-7q_n1fEZT_mumUoVBp2HfNPKHnqC3jTryRDL7hxAL\u002Fs1600\u002Fphish-shop.jpg","2026-10-14T17:09:15+00:00","2026-10-14T20:00:11.866281+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"CoGUI","product",{"name":24,"type":22},"NX",{"name":26,"type":22},"FA",{"name":28,"type":22},"Haozi",{"name":30,"type":22},"Phoenix","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[],[18,21,24],{"controls":57,"vendors":136},[58,85,110],{"slug":59,"name":60,"problem":61,"products":62},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[63,69,77],{"vendor_slug":64,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":64,"url":67,"description":68},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":86,"name":87,"problem":88,"products":89},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[90,97,102],{"vendor_slug":91,"vendor_name":18,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":98,"product_name":99,"url":100,"description":101},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,122,128],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":119,"url":120,"description":121},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":124,"url":126,"description":127},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[137],{"slug":91,"name":18,"logo_path":92,"roles":138},[139],"reported_by",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":155},"billion-message-phishing-campaign-disrupted-by-microsoft-coalition","Billion-Message Phishing Campaign Disrupted by Microsoft Coalition","Three sophisticated phishing kits — CoGUI, Haozi, and Iron Man System — collectively sent over one billion scam messages since January 2026, exploiting end-user trust and lack of phishing awareness at massive scale. The root issue is that phishing infrastructure can operate largely unimpeded until coordinated industry takedowns occur, meaning organizations cannot rely solely on reactive disruption efforts. This case highlights how phishing kits have become commoditized, lowering the barrier for threat actors to launch high-volume, convincing campaigns. Without robust user training, technical email controls, and threat intelligence sharing, organizations remain highly vulnerable between disruption events.",[145,146,147,148,149,150,151,152,153,154],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-177 – Trustworthy Email (DMARC\u002FSPF\u002FDKIM)","NIST AT-2 – Literacy Training and Awareness","NIST IR-6 – Incident Reporting","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","ITIL – Incident Management Practice",{}]