Phishing takedown targets the cloud accounts behind the scams

A phishing operation needs more than a convincing fake login page. It needs accounts, hosting and a steady supply of infrastructure. Microsoft, Health-ISAC and an international coalition have gone after that supply chain, disrupting infrastructure supporting three phishing kits linked to more than a billion malicious messages.

The activity targeted over 75,000 organizations across 150 countries, according to BleepingComputer’s account of the investigation. That billion-message figure covers email and SMS—not a billion compromised inboxes. The distinction matters: it describes the operation’s attempted reach, not how many people handed over credentials or lost money.

What happened

The disrupted kits were CoGUI, also known as NX or FA; Haozi, also called Phoenix; and Iron Man System. The Hacker News identifies the coalition as including Japan’s Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, alongside Microsoft and Health-ISAC.

The investigation began with Microsoft and Japan’s National Police Agency examining fraudulent activity. It led to YAM Store, a Chinese-language underground marketplace tracked as Storm-3119. Investigators linked that supplier to the three phishing kits, which are collectively tracked as Storm-2990. Those tracking names distinguish the infrastructure marketplace from the phishing platforms it supported.

Under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI and Iron Man. The reported court-authorized domain action names those services specifically; it should not be read as an identical seizure action against every kit in the wider investigation.

Microsoft separately says it deactivated more than 20,000 accounts associated with YAM Store and blocked 100,000 domains used for impersonation and fraud. These are different interventions: blocking a domain is not the same as seizing it. The 100,000 figure is therefore not a count of domains taken over through the court order.

More than 750 million malicious messages have targeted Microsoft customers since January 2026, across email and SMS. Many messages targeting Microsoft 365 customers used device-code phishing to obtain authentication tokens. That puts the requested sign-in action under scrutiny, not just whether a message leads to a page asking for a password.

The background

YAM Store supplied compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses and storage. Its role was broader than selling a ready-made scam page: it supplied the cloud resources that phishing operators could use to run their campaigns. The investigation followed those resources back to the identities and credentials used to acquire or control them.

One acquisition method relied on expired domains belonging to real organizations. Operators bought the domains, rebuilt websites and made defunct entities appear active again, then used those identities to obtain cloud accounts. The deception started before a phishing message was sent, with a borrowed organizational history helping an account application look credible.

Investigators also observed fake organizations supported by AI-generated content and documentation. That was a separate route to the same goal: obtaining cloud resources under a misleading identity. The reporting describes AI helping fabricate organizations; it does not establish that every lure or message in the billion-message total was AI-generated.

Inside compromised Microsoft environments, operators used stolen application credentials to manage accounts and licenses. They also abused SharePoint and OneDrive storage for hosting. These findings describe misuse of accounts and storage, not an established breach of the underlying SharePoint or OneDrive platforms. A genuine hosting service and an untrustworthy operator can occupy the same link.

The kits supplied familiar hooks: unpaid tolls, traffic penalties, delivery problems and account-verification requests. Their infrastructure also supported geofencing, fake CAPTCHA gates and IP filtering to obstruct security analysis. For email security, that combination matters because the visible lure was only one part of a system designed to make investigation harder.

CoGUI’s history predates the latest disruption. In late 2024, Proofpoint identified associated email campaigns consistently targeting Japan, with impersonation of well-known Japanese companies and international organizations used to seek credentials and payment data. Microsoft says CoGUI targeted the United States as well as Japan, before Iron Man pushed it aside by mid-2026.

What people are saying

Microsoft’s account emphasizes both the cloud-account supplier and the scale of the phishing platforms it supported. Its description of Iron Man includes more than 2,300 impersonation templates covering banks, retailers, delivery services and government agencies. That breadth gave operators a menu of identities to borrow rather than tying the service to a single brand or type of scam.

Resecurity’s investigation adds a view into the tooling behind that menu. Researchers examined exposed infrastructure, including a publicly exposed Git/container registry containing 911 published builds and eight registered accounts. Those are observations about the development infrastructure—not counts of attackers, customers or victims—and help show that the investigation extended beyond collecting malicious messages.

Resecurity also identified a product-selection subsystem linked to payment-card capture. It cataloged 2,360 phishing packages covering 130 countries or areas, with updates through October 1, 2026. That catalog’s geographic coverage is separate from the wider operation’s reported targeting across 150 countries; the two numbers describe different parts of the evidence.

Proofpoint’s earlier work found more than 17,000 domains used by CoGUI, CoAceV and CoFish_Ws. That is a different grouping from the three kits named in the current disruption. Researchers described the earlier operation as “dynamic” and sufficiently resourced to acquire and manage phishing infrastructure at scale, according to BleepingComputer’s reporting.

Taken together, these vendor findings describe several distinct layers: cloud-account procurement, phishing-kit development, impersonation catalogs and campaign domains. Their figures should not be added into a larger victim count. Builds, packages, accounts, domains and messages each measure something different, and none by itself establishes how many organizations suffered a successful intrusion.

What happens next

Investigators said additional infrastructure was still being removed based on the findings. The announced action is therefore a disruption with follow-on work, not evidence that every associated service has permanently disappeared. The reporting provides account and domain totals for actions already taken, but no final tally for the continuing cleanup.

For teams managing cloud-hosted email assets, the stolen application credentials are a concrete review point. Checking which applications can manage accounts and licenses addresses the kind of access investigators observed. Unexpected account or license changes deserve investigation, while credentials that no longer serve a business purpose should be revoked rather than left available for reuse.

For recipients, device-code phishing makes unexpected authentication requests an important warning sign even when a familiar sign-in service is involved. Senders can help by keeping customer verification instructions consistent and avoiding surprise authentication demands. The practical lesson is to assess the message, destination and requested action together—not treat a recognizable cloud URL as a safety certificate.