Microsoft Coalition Seizes CoGUI, Haozi, Iron Man Kits After 1B+ Phishing Messages
A coalition led by Microsoft disrupted three phishing kits that powered over one billion messages. Technical evidence shows shared Chinese infrastructure and abuse of hijacked Microsoft tenants. The takedown reveals ongoing gaps in cloud permission controls.
The operation targeted CoGUI, Haozi and Iron Man System kits sold through the YAM Store marketplace tracked as Storm-3119. Investigators traced the kits to Storm-2990 developers who automated discovery of expired Microsoft 365 and Google tenants via Tor, then resold hijacked SharePoint and OneDrive storage with app-only permissions. Evidence includes cryptocurrency transaction logs, PHP and Cloudflare Worker admin panels, and overlapping code across the three kits.
Microsoft began the probe in late 2025 after Japanese targets reported campaigns. The coalition documented 150 countries hit, with healthcare and finance sectors generating tens of millions in illicit revenue. Procurement records and job postings from Chinese IABs show repeated reuse of the same tenant takeover techniques, contradicting public claims of isolated actors.
The kits abused legitimate cloud infrastructure rather than bulletproof hosting, exposing a persistent blind spot in Microsoft Graph and SharePoint permission models. Overlap between the three kits and the YAM Store storefront indicates centralized development rather than loose collaboration.
Expect Storm-2990 to release updated kits within 60 days using new Cloudflare Workers templates. Organizations should audit Graph permissions and expired tenant claims immediately.
Storm-2990: Replacement kit variant advertised on YAM Store within 60 days
Sources (2)
- [1]Primary Source(https://www.microsoft.com/security/blog/2026/10/15/disrupting-phishing-kits)
- [2]Supporting Source(https://www.proofpoint.com/us/threat-insight/post/cogui-phishing-kit-japan)