Since January 2026, 3 powerful Chinese-language phishing kits have enabled over a billion malicious messages impersonating over 75,000 organizations worldwide. Microsoft has finally taken action.

The US tech giant says it worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a US court order seizing and redirecting domains that were part of the infrastructure underlying the 3 phishing kits: Haozi, CoGUI, and Iron Man.

Hundreds of millions of malicious messages, the sending of which was enabled by the aforementioned phishing kits, targeted consumers, healthcare organizations, financial institutions, and other businesses (over 75,000 in total) in more than 150 countries.

Their operators earned 10s of millions of dollars while the cybercriminals used the kits to steal credentials, personal information, banking data, and other login information.

“Microsoft assesses with high confidence that these phishing kits were developed by Chinese-speaking threat actors, and, despite their distinct branding and separate Telegram-based sales channels, exhibit highly similar capabilities and functionality,” the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit said in its blog.

Iron Man is a phishing-kit-as-a-service operation that offers cybercriminals more than 2,300 pre-built lure pages impersonating trusted services like postal companies, traffic fine offices, tax agencies, banks, or telecoms.

CoGUI also provides crooks with ready-made websites and messages that impersonate trusted brands, companies, financial institutions, and government agencies.

Interestingly, the tools seem to be the driving force behind many of the toll scam texts or fake delivery emails.

Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue,

Steven Masada, associate general counsel for Microsoft's Digital Crimes Unit, wrote in a blog post.

“The details may change, but the goal is the same: to get someone to click, share personal information, or pay.”

The operation is the result of an investigation Microsoft launched late last year after the company was notified of malicious messaging campaigns targeting people in Japan.

All 3 phishing kits are sold through the YAM Store, an underground marketplace tracked by Microsoft as Storm-3119.

YAM Store and affiliated phishing kit companies accepted cryptocurrency payments, including USDT and Ethereum, adding another layer of concealment for illicit activity.

“The scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses,” said the researchers.