> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
- URL: https://f4n6.co.uk/security-feed/microsoft-disrupts-3-phishing-kits-linked-to-over-1-billion-scam-messages/
- Published: 2026-10-14T20:57:11.000Z
- Updated: 2026-10-14T20:57:11.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Microsoft, Health-ISAC, the Japan Cybercrime Control Center (JC3) and a coalition of private sector firms including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs announced the disruption of three phishing kits: CoGUI (also tracked as NX or FA), Haozi (also tracked as Phoenix), and Iron Man System. The coalition states the actors behind these kits have been responsible for activity since January 2026, and the operation is linked to over 1 billion scam messages. No CVSS scores, CVE identifiers or CISA KEV entries are available for this item, and no MITRE ATT&CK profile was resolved for any named actor, so attribution to a specific tracked group is unconfirmed. For EMEA financial services the exposure is consumer-facing phishing and payment fraud delivered through commodity kit infrastructure, not a software vulnerability in your estate. The primary risk is brand abuse and authorised push payment fraud against customers, plus the possibility that disrupted kit infrastructure is replaced by successor kits within days.

## 2\. Regulatory framing

| Article                                                        | Trigger (the fact in this item)                                                                                                                                                                                 | Practical impact                                                                                                                                                           |
| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No specific DORA/NIS2 article is directly engaged by this item | The source describes a third-party-led disruption of phishing kits and does not state that any EMEA financial entity suffered an ICT incident, nor that a client's own ICT third-party arrangement was affected | No DORA or NIS2 reporting obligation is triggered by the disruption itself. Treat this as threat intelligence for fraud and brand-protection functions, not as an incident |

The source does not name any affected financial institution, does not describe an incident at a regulated entity, and does not identify a supplier in a client's own ICT supply chain. Mapping DORA Art. 17, 18, 19 or NIS2 Art. 23 to this item would be a compliance checkbox, not an obligation. If a client later confirms its customers were targeted through one of these kits, DORA Art. 18 classification and Art. 19 reporting would be assessed against that specific incident, not against this advisory.

## 3\. Technical analysis & attack chain

The source material is a short announcement. It names the three kits and the disrupting coalition, states the activity window (since January 2026) and the scale claim (over 1 billion scam messages), and stops there. No technical mechanism, no infrastructure, no payload detail, no CVE and no indicators are provided. The attack chain below is limited to what the source actually supports.

1. Threat actors operate one of three phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), or Iron Man System.
2. The kits are used to send scam messages at scale. The coalition attributes over 1 billion scam messages to the actors behind these kits since January 2026.
3. Microsoft, Health-ISAC, JC3 and private sector partners (Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs) disrupted the kits.

That is the full extent of the confirmed sequence. The source does not describe the delivery channel (SMS, email, messaging app), the hosting model, the credential or payment capture flow, or what "disruption" concretely means (sinkholing, domain seizure, takedown of hosting, arrests). It does not state whether the kits are sold as-a-service, whether they are custom-built per campaign, or how the operators monetise the captured data.

**Confidence caveats.** The 1 billion message figure and the January 2026 start date are single-sourced to the coalition announcement as relayed by The Hacker News. No independent corroboration is present in the material supplied. The kit aliases (CoGUI/NX/FA, Haozi/Phoenix) are naming conventions used by the coalition and may not match other vendors' tracking. No actor attribution to a named APT or cybercrime group is provided, and no MITRE ATT&CK profile was resolved, so any attribution claim beyond "the actors behind these kits" would be unsupported.

**What this means for a defender.** The absence of technical detail is itself the finding. There is nothing here to write a signature against, nothing to block at the perimeter, and no patch to apply. The actionable content is the kit names, which are useful for retrospective review of fraud cases and for threat-intel enrichment, and the coalition partners, which are the correct channels for follow-up intelligence requests.

## 4\. Mitigation & containment

Because the source provides no atomic indicators, no CVE and no infrastructure, the mitigations below are process and fraud controls, not technical containment. They are framed for a financial services environment where the exposure is customer-facing phishing and payment fraud.

### P1 (within 24 hours)

- Search fraud case management and customer contact logs for references to CoGUI, NX, FA, Haozi, Phoenix or Iron Man System. Kit names often surface in customer reports, takedown requests or law enforcement referrals before they appear in vendor feeds. Flag any match for retrospective review.
- Brief the fraud and customer protection teams on the three kit names and the January 2026 activity window so that inbound customer reports are triaged against this campaign rather than treated as isolated.
- Confirm that customer-facing scam reporting channels (in-app reporting, fraud hotline, email abuse mailbox) are staffed and that reports mentioning phishing kits are routed to the fraud intelligence function, not closed as generic spam.

### P2 (within 72 hours)

- Request the technical indicators from the coalition partners named in the announcement (Microsoft, Cloudflare, Proofpoint, Resecurity, TRM Labs) through existing intel-sharing relationships. The public announcement does not carry IOCs; the partners may distribute them under their own TLP to vetted recipients.
- Review payment verification and callback procedures for high-value outbound transfers. Phishing kits of this class typically feed authorised push payment fraud, and the control that catches it is a verified callback on a known number, not an email reply.
- Check whether any brand-protection or takedown vendor already has coverage of these kit families and, if not, ask them to add the kit names to monitoring.

### P3 (within 7 days)

- Run a retrospective fraud review over the January 2026 to October 2026 window for customer-reported phishing that matches the kit naming, and quantify any losses. This is the number that would feed a DORA Art. 18 classification if a client later determines it suffered an incident.
- Feed the kit names into the threat-intel platform as watch terms and set alerts for new reporting that adds infrastructure or indicators.
- Reassess customer awareness messaging if the retrospective review shows losses concentrated in a particular customer segment.

No vendor fix, patch or version pin applies. There is no software component in this item to remediate.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The source names three phishing kits and a coalition of disrupting organisations but provides no domains, IP addresses, URLs, file hashes, email addresses or other atomic indicators.

The kit names below are not indicators in the machine-pivotable sense. They are tracking names useful for intelligence enrichment and retrospective case review, and they are recorded here for that purpose only.

| type     | value               | confidence     | source                      |
| -------- | ------------------- | -------------- | --------------------------- |
| kit name | CoGUI (aka NX, FA)  | single-sourced | The Hacker News, 2026-10-14 |
| kit name | Haozi (aka Phoenix) | single-sourced | The Hacker News, 2026-10-14 |
| kit name | Iron Man System     | single-sourced | The Hacker News, 2026-10-14 |

No copyable indicator block is provided because no atomic indicators exist in the source. Do not treat the kit names above as blocklist entries.

## 6\. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The only named artefacts are the kit names themselves, which are reporting labels rather than artefacts of the threat, and a YARA or Sigma rule built on them would match intelligence reporting about the kits, not the kits. No rule is emitted.

If the coalition partners later publish infrastructure or payload detail, detection content can be authored against it. Until then, the detection value of this item is limited to the watch terms in §5.

## 7\. Sources

- The Hacker News, "Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages", https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html, 2026-10-14

This is the only source supplied. Every factual claim in this advisory traces to it, and the confidence caveats in §3 and §5 reflect that single-source basis.

## 8\. Adverse Trace position

Adverse Trace assesses this item as low direct technical severity for EMEA financial services clients and moderate fraud-relevance. There is no CVE, no CVSS score, no CISA KEV entry and no resolved MITRE ATT&CK profile, so we cannot assign a vulnerability severity and we will not manufacture one. The disruption is a law-enforcement and industry action against phishing kit infrastructure, and its value to clients is intelligence and fraud context, not a patch or a blocklist. The 1 billion message figure and the January 2026 activity window are single-sourced to the coalition announcement and should be treated as indicative rather than verified. Attribution to any named actor is unconfirmed. We will monitor for follow-up publications from Microsoft, Health-ISAC, JC3 and the named private sector partners that carry actual indicators, and we will issue a supplementary note if infrastructure or payload detail becomes available. Clients who want to act now should run the retrospective fraud review in §4 P3 and route any confirmed customer losses through their normal incident classification process.

---

[Read the original source →](https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*