Iron Man System (Malware): news timeline & CVEs

Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations

Resecurity says a Chinese phishing-as-a-service kit, Iron Man System, offered thousands of lures and a claimed billion messages.

Resecurity reported a Chinese-operated phishing-as-a-service platform, Iron Man System, after buying a license and testing version 6.3.1 in a lab. A report tied the network to a claimed one billion phishing messages and 75,000 organizations, without explaining how those figures were counted. Investigators documented 2,360 templates and 551 lure tags impersonating couriers, banks, tax agencies, retailers, and telecoms, with DHL, DPD, and Apple most represented. The Go kit uses a licensing backend, and a public Gitea registry exposed 911 images. Microsoft's Digital Crimes Unit assisted disruption, but recent builds indicated continued development.

Cyber Security Newsupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 14:25 UTC · 1d agoPhishing & fraud in the wild 13 sources2

Microsoft disrupts phishing network behind more than a billion scam messages

Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.

Microsoft and Resecurity identified YAM Store, tracked as Storm-3119, which sold the CoGUI, Haozi, and Iron Man System phishing kits attributed collectively to Storm-2990. Since January 2026 those kits helped send more than one billion phishing emails and SMS messages targeting over 75,000 organizations in healthcare, financial services, wholesale, and IT across Japan, the United States, Australia, and India. The market also sold compromised or fraudulently obtained Microsoft and Google cloud accounts, reset passwords, assigned licenses, and turned SharePoint and OneDrive into buyer hosting; Iron Man System contained more than 2,335 templates for over 139 countries and alerted operators on Telegram. With Health-ISAC and an order from the US District Court for the Southern District of Florida, Microsoft seized supporting domains, disabled more than 20,000 accounts, and blocked more than 100,000 impersonation domains after a late-2025 referral from Japan's National Police Agency.

Help Net Securityupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 10:10 UTC · 1d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

Microsoft and partners disrupted Yam Store, a phishing service behind over one billion messages since January 2026.

Microsoft and partners, including Japanese police, disrupted Yam Store (Storm-3119), a Chinese-language phishing-as-a-service marketplace. Its CoGUI, Haozi, and Iron Man System kits, tracked as Storm-2990, sent more than one billion phishing emails and texts to over 75,000 organizations since January 2026, hitting healthcare, finance, wholesale, and IT in Japan, the US, Australia, and India. Operators reused expired domains and fake tenants to obtain Microsoft 365 and Google accounts for resale, using fake login pages, device-code phishing, and payment theft. Microsoft disabled more than 20,000 accounts and blocked over 100,000 domains.

Infosecurity Magazineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 10:00 UTC · 1d agoPhishing & fraud in the wild 13 sources2

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.

Microsoft's Digital Crimes Unit says it dismantled YAM Store, a Chinese-language phishing-as-a-service marketplace, after a nearly year-long investigation that began with a late-2025 tip from Japan's National Police Agency. The marketplace and kits including Iron Man System, CoGUI, and Haozi enabled more than 1 billion malicious messages to over 75,000 organizations, including more than 750 million sent to Microsoft customers, and generated tens of millions of dollars. Customers bought fraudulent Microsoft and Google accounts, expired-domain infrastructure, and more than 2,300 lure templates impersonating organizations in over 150 countries. Partners included Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

CSO Onlineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 01:20 UTC · 2d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.

Microsoft, Health-ISAC, Japan’s JC3, and private partners announced a court-authorized disruption of phishing kits CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. Since January 2026, operators facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations in more than 150 countries, generating tens of millions of dollars. Microsoft tracks marketplace YAM Store as Storm-3119 and the kit developers as Storm-2990; the kits were sold for cryptocurrency and used compromised or fraudulent Microsoft and Google cloud tenants, including SharePoint and OneDrive hosting. About 17,000 domains and more than 2,300 brand-impersonation templates were involved, with real-world CoGUI use since at least October 2024.

The Hacker Newsupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 17:09 UTC · 2d agoPhishing & fraud in the wild 13 sources

Iron Man System

Timeline5 articles

Appears with

Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations

Microsoft disrupts phishing network behind more than a billion scam messages

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages