Phishing-as-a-service has a central kill switch

A coordinated law-enforcement and industry operation disrupted infrastructure behind a Chinese-language phishing-as-a-service ecosystem that sent more than 1 billion malicious messages to more than 75,000 organizations in 150 countries. The technical lesson is that this supposedly self-hosted criminal tooling retained a centralized licensing dependency that defenders could target.

Microsoft, Japan’s National Police Agency, Health-ISAC, Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs traced the activity through the YAM Store underground marketplace to phishing kits including CoGUI, Haozi, and Iron Man System. Microsoft tracks the marketplace as Storm-3119 and the linked kit ecosystem as Storm-2990.

The U.S. District Court for the Southern District of Florida authorized the disruption. Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man, deactivated more than 20,000 accounts tied to YAM Store, and blocked 100,000 domains used for impersonation and fraud.

That does not mean every deployed lure page immediately disappears. The kits are sold as deployable packages, and buyers can operate their own phishing frontends. But the investigation identifies an upstream choke point: Iron Man deployments regularly contacted a vendor-controlled authorization backend. Removing that service can impair the full buyer base at once instead of requiring defenders to find and block each fraudulent site independently.

Recommended reading

Vendor-held data is still Daiichi Kosho’s breach problem

Sergey Kuznetsov • Oct 11, 2026 • 8 min read

A marketplace selling cloud credibility

YAM Store sold more than phishing page templates. It supplied compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage. Investigators found operators acquiring expired domains belonging to legitimate organizations, rebuilding websites to make those defunct organizations appear active, and using those reconstructed identities to obtain cloud accounts.

The group also created fictitious organizations with supporting content and documentation generated with AI tools. A malicious page hosted on compromised or fraudulently obtained cloud infrastructure starts with platform legitimacy that a disposable domain lacks. In compromised Microsoft environments, operators used stolen application credentials to manage accounts and licenses, while SharePoint and OneDrive storage hosted content.

×

The operation produced unpaid-toll notices, traffic penalties, delivery failures, and account-verification prompts. The kits incorporated geofencing, fake CAPTCHA screens, IP filtering, and related controls to keep researchers and automated scanners away from the final credential- or payment-capture page.

Those measures explain why domain-blocking remains incomplete. A lure can be localized by geography, withheld from known security networks, and hosted behind infrastructure that appears to belong to a real cloud tenant. The takedown targeted the marketplace accounts, impersonation domains, kit infrastructure, and, in Iron Man’s case, the operating dependency behind the kit’s license checks.

×

Microsoft said that, since the beginning of 2026, more than 750 million malicious email and SMS messages had targeted Microsoft customers. Many used device-code phishing, a technique designed to obtain authentication tokens rather than simply collect a password. CoGUI focused on targets in the United States and Japan, but Microsoft said Iron Man had displaced it by mid-2026, aided by a catalog of more than 2,300 templates impersonating banks, retailers, delivery companies, and government agencies.

×

Iron Man was self-hosted, not independent

The most detailed public technical evidence comes from Resecurity’s analysis of Iron Man System and YAM Store. The company purchased a license, deployed the product in an isolated lab, inspected outbound traffic, and reviewed configuration artifacts from the vendor’s own build registry.

Iron Man System is a Go-backend phishing kit distributed as a container image. Buyers receive a bilingual Chinese-English administration panel for managing individually configured “frontends”: lure-page instances tied to an impersonated brand and concealed behind a hidden administration URL. Resecurity observed version 6.3.1 in its lab, with a running license-expiry countdown. A separate vendor-operated bootstrap console provisioned deployments.

The distinction between self-hosting and autonomy is central. The panel polled its local license-status endpoint roughly every 20 seconds using a vendor-issued key; that process triggered a server-side request to the confirmed authorization host. Resecurity verified the live backend through packet capture from its lab deployment and static configuration review. The kit could be installed on a buyer-controlled server, but it could not remain fully functional without recurring contact with vendor infrastructure.

Central licensing gives the vendor control over paying criminal customers and enables subscription sales, but it also creates infrastructure that can be sinkholed or seized. A takedown of a live authorization host can degrade active deployments across the customer base, whereas deleting a single lure server forces defenders to keep rediscovering clones.

×

The catalog and build pipeline point to an active service

Resecurity identified 2,360 distinct phishing packages spanning 130 countries or areas, impersonating banks, retailers, health-care providers, transportation authorities, police departments, government agencies, telecoms, and loyalty programs. The most recent template addition it observed was dated October 1, 2026. The catalog was being maintained during the disruption period, not recovered from an abandoned repository.

The group’s publicly accessible self-hosted Gitea and container-registry infrastructure exposed 911 published image versions and an unauthenticated directory listing eight registered accounts. The registry contained releases from at least mid-July through late July 2026 in the sample Resecurity reviewed, with a newer release published within days of its report. The account-creation dates ran from October 19, 2025 through June 9, 2026, showing a cluster that had operated for at least a year and continued adding accounts.

Resecurity also reviewed a configuration artifact inside a published container image. It indicated that the kit used an S3-compatible object-storage backend for uploaded or captured content, fronted by a CDN or reverse-proxy service. The researchers reported 17.4GB of captured telemetry in their high-level findings, while withholding installation details, working credentials, and other material that would enable abuse.

The visible build history provides more evidence than a static screenshot of a phishing panel. It shows software distribution, licensing, object storage, template production, and a maintenance cadence. These operational features make phishing-as-a-service scalable and give coordinated action shared dependencies to target.

What the campaign means for U.S. organizations

The lures were designed for broad consumer-facing fraud, but the operational target set included organizations and Microsoft 365 users. Device-code phishing is especially important in that setting because the desired result is an authentication token. An organization focused only on password-entry pages in its training and controls may miss the credential-theft flow used in these campaigns.

Our August 11, 2026 coverage of an AI-personalized phishing field study found that personalized phishing emails generated 2.4 times more clicks among 7,741 participants and cost about $0.03 each. This operation adds industrialized delivery and credential-capture infrastructure. AI-generated fake company documentation can help obtain cloud resources, while extensive template catalogs let buyers localize the final lure at scale.

Proofpoint had already connected CoGUI to campaigns consistently targeting Japan in late 2024, stealing credentials and payment information by impersonating well-known Japanese companies and international organizations. Its broader investigation identified more than 17,000 domains used by CoGUI, CoAceV, and CoFish_Ws. Microsoft’s account of Iron Man overtaking CoGUI by mid-2026 suggests the market was not fixed around one kit; disrupting only a current leader leaves the surrounding marketplace and reseller model intact.

Centralization is both the service’s advantage and its liability

The enforcement action has meaningful scope: 20,000 deactivated accounts and 100,000 blocked domains can cut off licensing, telemetry, and storage services as well as public lure pages. Yet the source material does not establish that all buyer deployments, all repositories, or every replacement authorization service have been eliminated. It says additional infrastructure was still being removed on October 14, 2026.

Iron Man’s architecture made the vendor’s control plane a high-value target, but its 911-build history shows that its operators had an active release process. The operation’s durability will depend on whether that pipeline and its replacement infrastructure can be rebuilt faster than authorities and cloud providers can identify the next shared dependency.