Microsoft and partners disrupt three phishing kits in court-authorized operation

Microsoft, Health-ISAC and partners announced a court-authorized disruption of the CoGUI, Haozi and Iron Man System phishing kits. Microsoft said their operators facilitated over one billion phishing emails and SMS messages to over 75 thousand organizations since January 2026. The investigation began in late 2025 after reports of malicious messaging campaigns targeting people in Japan. The kits supplied impersonation templates and operated alongside a marketplace selling access to compromised or fraudulently obtained cloud environments. Resecurity found that Iron Man System requires regular contact with its vendor's licensing server to function, creating a dependency defenders can exploit to degrade active deployments.