# Microsoft and partners disrupt three phishing kits in court-authorized operation

_Published Wednesday, October 14, 2026 at 4:08 PM EDT · Security · Latest · Tier 1 — Major_

![Microsoft and partners disrupt three phishing kits in court-authorized operation — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtmZA0sGFnGRVBoPOHXGNOr-Q1MpdbCUNVrfxBTV6z_URgCka1DOH4xcc_WuismhU3W1BEiostTKZetIhtrFyXrInKdz_jqK6Dtia5TDOqRiu4rkktKmF2Iz1br28coCyU3c5td-yrINUgjYIdwG-7q_n1fEZT_mumUoVBp2HfNPKHnqC3jTryRDL7hxAL/s1700-nu-rw-lo-l85-e365/phish-shop.jpg)

Microsoft, Health-ISAC and partners announced a court-authorized disruption of the CoGUI, Haozi and Iron Man System phishing kits. Microsoft said their operators facilitated over one billion phishing emails and SMS messages to over 75 thousand organizations since January 2026.

The investigation began in late 2025 after reports of malicious messaging campaigns targeting people in Japan. The kits supplied impersonation templates and operated alongside a marketplace selling access to compromised or fraudulently obtained cloud environments.

Resecurity found that Iron Man System requires regular contact with its vendor's licensing server to function, creating a dependency defenders can exploit to degrade active deployments.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html)

---
Canonical: https://techandbusiness.org/newswire/gXOnasOVW4rPcrXxU84V0T
Published: 2026-10-14T20:08:29.446Z
Story chronology: 2026-10-14T17:09:15.000Z
Retrieved: 2026-10-14T22:17:43.812Z
Publisher: Tech & Business (techandbusiness.org)