Microsoft Takes Down Phishing Kits Behind 1 Billion Scam Messages: What It Means for You

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

On October 14, 2026, Microsoft and Health-ISAC, the information-sharing group for the healthcare industry, announced the disruption of three phishing kits and the marketplace that supplied them. According to The Hacker News, Microsoft says the people behind the kits have facilitated the sending of "over one billion phishing emails and SMS messages to over 75 thousand organizations worldwide" since January 2026.

This is good news, and worth understanding. The scams in question are the ones many of us see on our own phones: the unpaid toll, the missed delivery, the "verify your account" message. Here is what was taken down, how the kits worked, and what still protects you when the next set appears.

What Was Taken Down

Three phishing kits were disrupted: CoGUI, Haozi and Iron Man System. Microsoft tracks the developers behind them as Storm-2990. They were sold through YAM Store, a marketplace Microsoft tracks as Storm-3119. As BleepingComputer reports, the action ran under an order from the U.S. District Court for the Southern District of Florida, and Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI and Iron Man.

The numbers reported so far:

• More than 1 billion malicious messages since January 2026, aimed at consumers and more than 75,000 organizations in more than 150 countries.
• More than 750 million of those messages were aimed at Microsoft customers, according to SecurityWeek.
• Over 20,000 accounts tied to YAM Store were deactivated, and more than 100,000 impersonation and fraud domains are being blocked.
• Health-ISAC says the messages generated "tens of millions of dollars" for the operators.

Microsoft says the investigation began in late 2025, when Japan's National Police Agency alerted it to scam campaigns targeting people in Japan. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined the effort.

Why Health-ISAC Got Involved

Health-ISAC joined the lawsuit because, as SecurityWeek puts it, threat actors frequently used this infrastructure to target hospitals and healthcare organizations. Court filings quoted by GovInfoSecurity describe one Health-ISAC member that suffered an intrusion after a user unknowingly clicked a malicious link in a CoGUI phishing email.

That is the pattern worth remembering. One click by one person, on a message that looked routine, was enough to put an organization's systems at risk. The reported targets also included financial services, wholesale distribution and IT companies, across Japan, the US, Australia and India.

How the Kits Worked

These were not crude, one-off scam pages. They were products, sold to other criminals, with a catalog of ready-made lures.

• Ready-made disguises. Iron Man System offered more than 2,335 templates tailored to over 139 countries, per Microsoft. BleepingComputer lists the lures as "unpaid tolls, traffic penalties, delivery problems, and account verification requests." SecurityWeek adds that most US lures impersonated transportation and government entities, including the authorities that handle traffic and parking fees.
• Live, interactive pages. Microsoft says the kits were live platforms for credential harvesting, where operators could watch a victim in real time and prompt them for one-time verification codes. The Hacker News adds that operators got a Telegram alert when someone acted on a lure.
• Hiding from defenders. BleepingComputer reports the kits used geofencing, fake CAPTCHA gates and IP filtering to obstruct security analysis, so a scanner or a visitor from the wrong country sees a harmless page.
• Borrowed trust. YAM Store hijacked Microsoft 365 and Azure for Education tenants and resold the stolen accounts, licenses and storage. Microsoft also says many of the messages used device-code phishing to obtain authentication tokens.
• Volume. BleepingComputer reports that more than 17,000 domains were used by three related kits: CoGUI, CoAceV and CoFish_Ws.

The device-code trick is the same technique we explained in our post on the EvilTokens phishing service: the victim is persuaded to type a short code into a real login page, which hands the attacker a sign-in token.

What the Takedown Does Not Fix

Microsoft is clear about the limits. Steven Masada, who leads Microsoft's Digital Crimes Unit, said that "YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on."

Cybersecurity Dive reports that Microsoft acknowledged the operation would put only a dent in the broader phishing ecosystem. Domains can be replaced, and Masada's own words point to a larger network that remains. Resecurity found one useful weakness: the Iron Man panel needs regular contact with the vendor's licensing server, so disabling that server would degrade active deployments. That helps defenders now, but it is not a permanent fix.

So the practical takeaway is simple. Expect these message styles to keep arriving, and build habits that work whichever kit sends them.

What Actually Protects You

Habits that work against any kit

• Do not use the link in the message. If a text says you owe a toll or a parking fine, open the official site or app yourself and check there. Never pay through a link in an unexpected text.
• Treat verification codes as private. If a page asks for a code you were sent, stop. Because kits like these can prompt for one-time codes live, a code typed into a fake page can be used immediately.
• Be wary of device codes you did not start. If a page asks you to enter a code to sign in and you did not begin that sign-in, close it.
• Use passkeys where offered. A passkey is tied to the real website, so it will not work on a lookalike page.
• Use a different password on every account, so one stolen login does not open the rest. See how credential stuffing turns one leak into many break-ins.

Where CyberFence helps, and where it does not

• Web Shield DNS blocking blocks connections to domains on known malware and phishing lists. With thousands of lure domains in circulation, that stops many clicks before the page loads. It cannot catch a brand-new domain nobody has reported yet. We explain the mechanism in how DNS filtering works.
• Breach Monitor, a separate CyberFence product, alerts you when your email appears in a known data leak, so you can change a password sooner. It is not part of the $7.99 plan. See what Breach Monitor is.
• A VPN on its own does not stop phishing. AES-256-GCM encryption protects your traffic from snoops on the network, but it cannot stop you from typing a password into a fake page. Our guide on whether a VPN protects from phishing goes through this in detail.

In short: careful habits come first, and tools like DNS blocking add a safety net for the click you did not think twice about. For a longer look at how scams are changing, read our piece on AI-powered phishing in 2026.

A Quick Checklist for Small Teams

• Tell staff plainly what toll, delivery and account-verification scams look like, and that reporting a mistake early is welcome.
• Turn on two-step sign-in everywhere, and move to passkeys where you can.
• Agree on one rule: nobody enters a verification code on a page they reached from a message.
• Give people a simple place to forward suspicious messages.
• If someone clicks, change that password straight away and check for sign-ins you do not recognize.

The Bottom Line

The takedown of these three phishing kits removes a large supplier of ready-made scams, and Microsoft deserves credit for pursuing the sellers rather than only the senders. But the scam message is only the visible part. The tools, accounts and domains behind it can be replaced, so your own habits matter most. Slow down on urgent messages, never share codes, use unique passwords, and add DNS blocking as a backstop.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .