Microsoft-Led Coalition Disrupts Three Major Phishing Kits Linked to Over 1 Billion Scam Messages

In a coordinated effort to combat large-scale credential phishing, Microsoft and Health-ISAC, in partnership with the Japan Cybercrime Control Center (JC3) and a coalition of private sector firms including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits: CoGUI (also known as NX or FA), Haozi (aka Phoenix), and Iron Man System.

According to reports, the threat actors behind these kits have been responsible for a campaign of unprecedented scale, having sent over 1 billion scam messages since as early as January 2026. The phishing kits were designed to mimic legitimate login pages and deliver credential-stealing payloads, targeting victims globally across multiple languages and sectors.

The coalition stated that infrastructure associated with the kits has been dismantled, effectively cutting off the threat actors' ability to deliver phishing messages at the previously observed scale. The disruption includes seizure of domain names, server infrastructure, and communication channels used to orchestrate the campaigns.

Health-ISAC, which represents the healthcare and public health sector, highlighted the particular relevance of this action given the sector's elevated risk from credential phishing. Oracle and Proofpoint provided threat intelligence and infrastructure analysis, while Cloudflare and TRM Labs contributed network defense and blockchain forensics capabilities, respectively.

The companies involved have urged organizations to remain vigilant, noting that threat actors frequently rebrand and launch new phishing kits following disruptions. User awareness training and multi-factor authentication were cited as critical defensive measures.