Blow to three phishing platforms behind more than 1,000 million messages
A court-authorised operation against three phishing-as-a-service platforms that, according to its backers, carried more than 1,000 million fraudulent emails and texts.
What happened
A court-authorised operation led by Microsoft with Health-ISAC, the Japan Cybercrime Control Center and companies including Cloudflare, Proofpoint, Oracle, Resecurity and TRM Labs targeted three phishing-as-a-service platforms: CoGUI, Haozi and Iron Man System. According to the participants, since January 2026 they carried more than 1,000 million fraudulent emails and SMS messages against more than 75,000 organisations in over 150 countries. All three were sold on the same underground market, run by Chinese-speaking actors and shared infrastructure.
Why it matters
Phishing is now rented as a service, with templates that mimic well-known brands, filters to dodge investigators and real-time password capture that defeats some forms of two-factor authentication. Campaigns were hosted on compromised or abandoned Microsoft 365 and Google environments and used SharePoint and OneDrive so links looked trustworthy. Taking down three platforms does not end the problem: their operators tend to resurface under other domains.
What we recommend
Phishing-resistant two-factor authentication —passkeys or hardware keys— on critical accounts, because SMS or app codes can be captured in real time; close Microsoft 365 or Google environments, accounts and licences that are no longer used; train staff with simulations that include SMS and SharePoint or OneDrive links; and confirm any payment or bank-detail change request through an independent channel.
Related service: Cybersecurity
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.