The Phishing Email Is the Smallest Part of the Attack

Most phishing advice starts with the email, and that makes sense, because the email or text message is the only part anyone in your organisation ever sees. On 14 October 2026, Microsoft described what sits behind those messages in one Chinese-language criminal ecosystem, and it looks far less like a lone attacker and far more like a small software industry with suppliers, subscriptions and a shopfront.

Microsoft says three phishing kits and an underground marketplace supplied the tooling, hosting and hijacked cloud accounts for phishing at very large scale, and that it has disrupted the main developers and infrastructure. For defenders, the useful lesson is that the message people receive is the cheapest, most replaceable part of the operation, so the human layer needs habits that work whoever sent it.

What Microsoft says it disrupted

In its threat intelligence write-up, Microsoft Threat Intelligence and its Digital Crimes Unit (DCU) say they worked with law enforcement and industry partners to disrupt the primary developers and infrastructure behind three phishing kits: CoGUI, Haozi and Iron Man System. Microsoft tracks the developers as Storm-2990, and an associated underground marketplace called the YAM Store as Storm-3119. It assesses with high confidence that Chinese-speaking actors developed the kits.

Microsoft reports that, since January 2026, operators of these kits have facilitated over one billion phishing emails and SMS messages to over 75 thousand organisations worldwide. The targeting it describes is concentrated on healthcare, financial services, wholesale distribution and IT, in Japan, the United States, Australia and India.

The Hacker News report adds detail from the partners involved. It says the operation was court-authorised, that Health-ISAC put the reach at more than 150 countries with operator earnings in the tens of millions of dollars, and that around 17,000 unique domains were used across the three kits. Those extra figures come from the partners as reported, not from Microsoft's own post, so treat them as reported claims rather than independently verified numbers.

A phishing kit is a product, not a trick

Iron Man System, advertised from June 2026, is the clearest example. Microsoft says it ships with over 2,335 templates tailored to over 139 countries. Access is by subscription through a license server, with the buyer's domain hard-coded into the kit. The lures impersonate local government (including traffic and parking authorities), law enforcement, healthcare, finance, transport and retail, and most of the US lures Microsoft saw were transport or government related.

The kits also carry the evasion features you would expect from a commercial product: geofencing, fake CAPTCHA gates, and IP allow and block lists. Real-time WebSocket collection lets operators watch victims and control what they see, with Telegram alerts when credentials, card data or verification codes arrive.

That last feature matters. A static fake page captures what you type and stops there. A live channel means someone can react while you are still on the page. That is our reading rather than a claim Microsoft makes in those words, but it fits the description: a code typed into a page like that is only as safe as the page it was typed into.

The marketplace that keeps it supplied

The YAM Store (Storm-3119) is described by Microsoft as an initial access broker, and the five-stage pipeline it sets out is worth reading closely:

• Reconnaissance: tooling run anonymously through Tor to find and profile cloud-enabled organisations.
• Environment takeover: using stolen client secrets, operators silently reset passwords, assign education licences and grant privileged attributes.
• Storage abuse: compromised tenants are used to provision a service principal with broad Microsoft Graph permissions, and SharePoint and OneDrive are abused for bulk hosting.
• Phishing infrastructure: a custom DNS platform manages phishing domains, certificates and routing.
• Monetisation: the hijacked accounts, licences and storage are resold through an automated storefront.

Buyers could pay through Alipay, WeChat Pay, USDT or Ethereum, and Telegram handled orders and buyer contact. Microsoft also describes fraudulent organisations created to lend credibility to new tenants, including a fake nonprofit whose website domain had been registered only months earlier.

One practical consequence is our own inference from this, not a Microsoft finding: if phishing content can be hosted on genuine cloud storage, or sent from a genuine tenant, then a familiar-looking domain stops being good evidence that a link is safe.

What this means for the people in your organisation

Microsoft's DCU is quoted in The Hacker News as saying, "The scam message is often the only part victims see." That is exactly why the human layer should be built around actions, not around spotting flaws. A well-made lure in a local language, from a plausible sender, will often look fine. What people can do reliably is pause, verify through another route, and report.

Microsoft's own guidance points the same way: check the purported sender independently, even for sign-in pages that look familiar, call the organisation directly, and check that a sign-in prompt names the application you expect. A few measures cover both the people and the platform:

• Make reporting a one-click habit, and thank people who use it, including when the message turns out to be harmless.
• Teach a second-channel check for anything involving a fine, a payment, a parcel or a sign-in: use a saved bookmark or a phone number you already trust, not the one in the message.
• Move towards phishing-resistant sign-in such as passkeys, and, as Microsoft advises, allow MFA and passkey registration only from trusted locations and devices.
• Apply least privilege and lock down Global Administrator roles, since Microsoft says Storm-3119 has been observed obtaining that access.
• Use Safe Links for internal recipients and block known malicious domains at the network edge.
• Run simulations that look like what is really arriving, such as local government, parking, transport and delivery notices, rather than only generic invoices.

The bottom line

A takedown removes some infrastructure and some developers. It does not remove the demand, and Microsoft's description of a modular marketplace suggests the parts can be rebuilt and resold. The sensible response is proportionate: assume the next message will be convincing, give people a simple way to check and report it, and limit what a single stolen sign-in can reach.

Sources: Microsoft Security Blog, 14 October 2026; The Hacker News, 14 October 2026.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.