Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials
Chinese-language phishing kits used about 17,000 domains to steal credentials from Japanese bank and retail customers.
78
Organization
Resecurity
- Mentions · 7d0
- Mentions · 30d16
- All mentions17
- First seenAug 17, 2026
- Last mentioned14d ago
Timeline
17 articles · newest firstMicrosoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.
78
Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations
Resecurity says a Chinese phishing-as-a-service kit, Iron Man System, offered thousands of lures and a claimed billion messages.
72
Iron Man Phishing-as-a-Service Kit Impersonates Banks, Couriers and Government Agencies Worldwide
Iron Man phishing-as-a-service impersonates banks and agencies; Microsoft tracks its developers as Storm-2990.
78
Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.
80
As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages
Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.
82
Yam Store: The Phishing Network Behind a Billion Messages
Microsoft says Yam Store, tracked as Storm-3119, fueled over one billion phishing emails and texts.
78
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.
82
Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
Microsoft disrupted three Chinese phishing platforms that enabled more than 750 million impersonation messages.
80
Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
82
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.
83
Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.
84
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft details a Chinese-language phishing-kit market that enabled over one billion messages to 75,000 organizations.
80
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention
Germany arrested a suspected Qilin leader extradited from Japan, while the gang kept listing new victims.
76
Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users
Resecurity found a yard-management app’s forged session cookies bypassed Entra ID MFA and impersonated users.
52
Authentication Bypass Successfully Impersonated 95 Users Without Passwords or MFA
Testers forged session cookies on a yard-management app and impersonated 95 users without passwords or MFA.
50
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.
84
Appears with
- Microsoftorganization · 13
- Microsoftvendor · 13
- CoGUImalware · 11
- Health-ISACorganization · 9
- Microsoft 365product · 8
- Haozimalware · 8
- Googlevendor · 8
- Storm-3119threat actor · 7
- TRM Labsorganization · 7
- Cloudflareorganization · 7
- Storm-2990threat actor · 7
- Oracleorganization · 7
- Proofpointorganization · 7
- Iron Manmalware · 6
- Iron Man Systemmalware · 4
- Japan Cybercrime Control Centerorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.