Iron Man (Malware): news timeline & CVEs

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.

Microsoft, Health-ISAC, and partners disrupted the CoGUI phishing kit plus related YAM Store and Iron Man fraud infrastructure, seizing domains after a civil lawsuit in the Southern District of Florida. Proofpoint says CoGUI alone generated more than 100 million malicious emails a month, while Microsoft cited more than one billion messages targeting over 75,000 organizations since January 2026. Related kits CoAceV and CoFish_Ws share roots and mainly target Japan, impersonating brands such as Amazon, Apple, PayPay, and Rakuten to steal credentials and card data. Proofpoint recorded 1,081 CoGUI campaigns and about 17,000 unique domains across the three kits.

GBHackersupdated Oct 16, 11:26 UTC · 17h agofirst Oct 16, 08:54 UTC · 20h agoPhishing & fraud in the wild 13 sources2· 1 read

Iron Man Phishing-as-a-Service Kit Impersonates Banks, Couriers and Government Agencies Worldwide

Iron Man phishing-as-a-service impersonates banks and agencies; Microsoft tracks its developers as Storm-2990.

Resecurity and Microsoft describe Iron Man System, a commercial phishing-as-a-service kit that supplies self-hosted sites impersonating banks, couriers, tax agencies, and other organizations. A lab deployment of version 6.3.1 used a Go backend, and Resecurity counted 2,360 templates across 130 countries, with licensing tied to api2.peaceman.cc. Operators collect credentials, payment data, and verification codes over WebSockets and can steer sessions interactively, with Telegram notifications, geofencing, fake CAPTCHA gates, and IP filtering. Microsoft tracks the developers of Iron Man, CoGUI, and Haozi as Storm-2990 and links the wider YAM Store ecosystem, tracked as Storm-3119, to more than one billion malicious messages since January 2026, a figure not exclusive to Iron Man. Microsoft and Health-ISAC obtained a Florida federal order to seize supporting domains.

GBHackersupdated Oct 16, 11:26 UTC · 17h agofirst Oct 15, 10:32 UTC · 1d agoPhishing & fraud in the wild 13 sources

Global takedown hits network behind 1 billion phishing messages

Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.

Microsoft, Japan’s National Police Agency, and partners disrupted YAM Store (Storm-3119) and phishing kits CoGUI, Haozi, and Iron Man, tracked as Storm-2990. The ecosystem is linked to more than a billion malicious email and SMS messages aimed at over 75,000 organizations in 150 countries, including over 750 million messages to Microsoft customers, many using device-code phishing. Operators bought expired domains, built fake organizations with AI, and abused SharePoint and OneDrive. Under a Southern District of Florida order, Microsoft seized related domains, deactivated over 20,000 accounts, and blocked 100,000 impersonation domains.

BleepingComputerupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:12 UTC · 2d agoPhishing & fraud in the wild 13 sources

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft details a Chinese-language phishing-kit market that enabled over one billion messages to 75,000 organizations.

Microsoft’s Digital Crimes Unit described a Chinese-language phishing ecosystem centered on YAM Store, tracked as Storm-3119, which brokers compromised or fraudulently obtained Microsoft and Google cloud environments. Kits sold there—CoGUI, Haozi, and Iron Man, tracked collectively as Storm-2990—facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations since January 2026. Targets included healthcare, financial services, wholesale distribution, and IT organizations in Japan, the United States, Australia, and India. Storm-3119 used Tor-anonymized reconnaissance to profile Microsoft 365 tenants, then hijacked education tenants and resold accounts, licenses, and storage; Microsoft and partners disrupted the primary infrastructure.

Microsoft Security Blogupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:00 UTC · 2d agoThreat actor in the wild 13 sources

Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem

Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.

Microsoft, Japanese authorities, Health-ISAC, and several security companies disrupted Chinese-language phishing kits tracked as Storm-2990. Since the start of 2026, the kits sent more than one billion phishing emails and SMS messages to more than 75,000 organizations, with more than three-quarters aimed at Microsoft customers. Under a federal court order, Microsoft and Health-ISAC seized and redirected domains powering YAM Store, CoGUI, and Iron Man; Microsoft also disabled more than 20,000 accounts and is blocking more than 100,000 impersonation domains. Criminals used the kits to steal credentials and financial data and abused device-code authentication to obtain tokens, mainly for payment fraud against healthcare, finance, logistics, and IT targets in the United States and Japan.

CyberScoopupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:00 UTC · 2d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.

Microsoft and Health-ISAC, under an order from the US District Court for the Southern District of Florida, seized and redirected domains used by YAM Store, CoGUI, and Iron Man. Microsoft says those services sent more than one billion malicious messages since January 2026 to consumers and over 75,000 organizations in more than 150 countries, including over 750 million aimed at Microsoft customers. YAM Store, tracked as Storm-3119, resold compromised Microsoft 365 and Azure for Education tenants, while CoGUI, Haozi, and Iron Man are Storm-2990 phishing kits that harvest credentials and one-time codes. Microsoft disabled over 20,000 related accounts and is blocking more than 100,000 impersonation domains.

SecurityWeekupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:00 UTC · 2d agoPhishing & fraud in the wild 13 sources

Iron Man

Timeline6 articles

Appears with