Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials
Chinese-language phishing kits used about 17,000 domains to steal credentials from Japanese bank and retail customers.
78
Organization
Health-ISAC
- Mentions · 7d0
- Mentions · 30d9
- All mentions17
- First seenAug 31, 2026
- Last mentioned15d ago
Timeline
17 articles · newest firstMicrosoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.
78
Iron Man Phishing-as-a-Service Kit Impersonates Banks, Couriers and Government Agencies Worldwide
Iron Man phishing-as-a-service impersonates banks and agencies; Microsoft tracks its developers as Storm-2990.
78
Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.
80
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.
82
Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
Microsoft disrupted three Chinese phishing platforms that enabled more than 750 million impersonation messages.
80
Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
82
Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.
84
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.
83
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
75
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
84
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.
58
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
77
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.
73
McKesson copes with fallout from data theft extortion attack
McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.
80
Appears with
- Microsoftorganization · 16
- Cloudflareorganization · 12
- Microsoftvendor · 12
- TRM Labsorganization · 11
- Resecurityorganization · 9
- Microsoft 365product · 9
- CoGUImalware · 8
- Proofpointorganization · 6
- Storm-2990threat actor · 6
- Oracleorganization · 6
- SpyCloudorganization · 6
- OpenAIorganization · 6
- Iron Manmalware · 5
- Storm-3119threat actor · 5
- Coinbaseorganization · 5
- Haozimalware · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.