Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages
Microsoft, Health-ISAC, JC3, and private partners disrupted three major phishing kits responsible for over 1 billion scam messages since January 2026, targeting global phishing campaigns.
Why it matters
Taking down these phishing kits reduces the overall volume of phishing attacks, decreasing potential exposure for users and organizations worldwide.
SOC impact
Monitor for residual or evolving phishing activity linked to CoGUI, Haozi, and Iron Man System kits. Review telemetry for signs of ongoing or new campaigns using similar tactics and validate if any organizational users were targeted by these kits.
Recommended actions
- Identify any recent phishing attempts associated with the disrupted kits
- Review email gateway and endpoint logs for related indicators
- Assess user reports and phishing complaint channels for residual impact
- Coordinate with threat intelligence providers for updates on emerging phishing kits
- Monitor for changes in phishing tactics following these takedowns
Executive Summary
Microsoft collaborated with Health-ISAC, JC3, and various private sector partners to disrupt three prolific phishing kits known as CoGUI, Haozi, and Iron Man System. These kits have been responsible for distributing more than one billion scam messages globally since early 2026. This joint operation significantly hinders threat actors who have heavily relied on these tools for phishing campaigns worldwide.
Operational teams should focus on detecting any lingering or adaptive phishing activity stemming from these kits. Monitoring should emphasize email and endpoint logs for indicators of compromise, as well as ongoing user reports. The disruption of these kits may lead adversaries to develop new strategies, requiring continuous vigilance and coordination with threat intelligence sources to track evolving threats.
SOC Impact
Monitor for residual or evolving phishing activity linked to CoGUI, Haozi, and Iron Man System kits. Review telemetry for signs of ongoing or new campaigns using similar tactics and validate if any organizational users were targeted by these kits.
Phishing Campaign Monitoring and Exposure Assessment
- Identify any recent phishing attempts associated with the disrupted kits
- Review email gateway and endpoint logs for related indicators
- Assess user reports and phishing complaint channels for residual impact
- Coordinate with threat intelligence providers for updates on emerging phishing kits
- Monitor for changes in phishing tactics following these takedowns
Why It Matters
Taking down these phishing kits reduces the overall volume of phishing attacks, decreasing potential exposure for users and organizations worldwide.