Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations

A Chinese-run phishing network has been linked to one billion phishing emails targeting 75,000 organizations, according to a report published on October 14, 2026.

The operation centers on Iron Man System, a paid phishing platform that lets criminals deploy fake websites and collect sensitive information without building their own tools.

The report lists those headline figures but does not explain their measurement period or counting method. Its detailed findings document 2,360 phishing templates covering 130 countries and areas.

These numbers describe the network’s reported reach and available tools, not confirmed breaches at every targeted organization.

Researchers from Resecurity identified and mapped the operation after buying a license and running the software in an isolated lab.

Their technical investigation into Iron Man describes a phishing kit rather than malware installed on victims’ devices. The team also entered communities managed by Chinese threat actors to investigate its developers and associates.

Chinese Phishing Network Linked to 1 Billion Messages

Iron Man System uses a Go backend and arrives as a container image, allowing buyers to run the package on their own servers.

Its Chinese-English control panel manages fake pages, brand settings, and license status. Researchers tested version 6.3.1, which displayed a subscription countdown and configured payment-related lures.

This commercial model lowers the skill needed to run phishing campaigns. Earlier reporting on Chinese language phishing services explains how ready-made templates and shared panels help criminals target several countries at once.

That wider trend provides context, but does not establish that separate services share Iron Man’s operators. The template library impersonated couriers, banks, tax agencies, retailers, telecom providers, and public bodies.

DHL had the largest individual template count, with 37, followed by DPD with 24 and Apple with 23. Delivery-related brands formed the largest category, reflecting the appeal of familiar parcel notices as phishing bait.

Comparable tactics appeared in the Panda Shop smishing kit, which used fake delivery and banking pages to collect financial information. Iron Man’s confirmed scope is distinct: its library included 551 lure-type tags, with entries updated as recently as October 1, 2026.

Researchers found a publicly accessible Gitea server holding the kit’s code and container registry. It exposed 911 published image versions and eight registered accounts. Recent releases showed continued development, while matching project names tied the registry directly to the tested package rather than an unrelated mirror.

Build settings revealed S3-compatible storage and a MariaDB database configured on internal addresses. Static credentials appeared across historical builds, although Resecurity withheld their values.

Code analysis also linked product catalogs and uploaded images to captured records containing selected goods and payment-card fields.

The reusable design resembles the business approach described in the Darcula phishing service report, where subscribers receive branded templates and ongoing updates. However, the Iron Man findings do not establish that it uses Darcula’s messaging channels or shares its developers.

The lab panel checked its local license status roughly every 20 seconds, triggering server-side contact with the vendor’s authorization host.

This dependency offers defenders a central disruption point: disabling the licensing service could affect many deployments together instead of requiring separate action against each fake website.

Resecurity said Microsoft led the wider operation and its Digital Crimes Unit helped disrupt developers and infrastructure. Still, recent builds indicated ongoing activity. Attribution remains limited: the report links infrastructure and accounts, but confirms no operator’s real-world identity.

Indicators of compromise (IoCs):-

Type	Indicator	Role or qualification
Domain	api2[.]peaceman[.]cc	Confirmed licensing backend
Domain	ipapi2[.]peaceman[.]cc	Auxiliary API
Domain	bin2[.]peaceman[.]cc	Auxiliary API
Domain	log2[.]peaceloving[.]xyz	Telemetry and logging
Domain	ossapi[.]haoeryu[.]top	Object storage
Domain	docker[.]aidchildren[.]cc	Gitea build registry
Domain	docker[.]loveboy[.]xyz	Alternate registry hostname
Domain	install[.]loveboy[.]xyz	Deployment console
Domain	api2[.]haoyutai[.]cc	Retired configuration value
IP address	104[.]26[.]8[.]8	Observed CDN fronting address
IP address	172[.]67[.]149[.]149	Observed logging CDN address
IP address	194[.]233[.]80[.]219	Research lab; not attacker infrastructure
Account email	aidchildren[@]mail[.]com	Registry account: admin
Account email	bsn[@]qq[.]com	Registry account: bsn
Account email	sgkj7856[@]gmail[.]com	Registry account: sg6688
Account email	1253261414[@]qq[.]com	Registry account: Po
Account email	fackyouhaozi[@]qq[.]com	Registry account: fackyouhaozi
Account email	kubile[@]gmail[.]com	Registry account: kubile
Account email	j6745g[@]protonmail[.]me	Registry account: jerry
Account email	wfd4as567[@]gmail[.]com	Registry account: wfd4as567

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.