Global Takedown Disrupts Phishing Ecosystem Behind 1 Billion Messages

· Cybersecurity · United States · Japan

Microsoft, Health-ISAC and law enforcement agencies including Japan's National Police Agency and the JC3 disrupted a sprawling phishing ecosystem responsible for more than one billion malicious messages sent to over 75,000 organizations in 150 countries. A U.S. court order allowed authorities to seize and redirect domains powering three Chinese-language phishing kits: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System. Private companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs supported the operation. The kits supplied cloud infrastructure and phishing tools to cybercriminals worldwide. The action is part of a broader effort to dismantle the criminal marketplaces that lower the barrier to large-scale phishing campaigns.

Why it matters：Mass-market phishing kits industrialize credential theft and fraud, so dismantling their shared infrastructure can meaningfully raise costs for the criminals and reduce a major attack vector for organizations worldwide.

Key points

  • The disrupted kits are CoGUI (NX/FA), Haozi (Phoenix) and Iron Man System, all Chinese-language.
  • A U.S. court order enabled seizure and redirection of the underlying domains.
  • Multiple private cybersecurity firms and Japan's national police assisted the operation.

Sources (original reporting)

More stories from this day