Microsoft, Health-ISAC, Japanese authorities, and others disrupt a Chinese-language phishing kit ecosystem used to send 1B+ messages to 75K+ entities in 2026

In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages …

CyberScoop 2026-10-15 Matt Kapko

Context & Ripple Effects

Microsoft had already documented a market for phishing-as-a-service subscriptions and template-based tools in 2021, while a 2022 campaign showed how phishing operators could target more than 10,000 organizations by hijacking Office 365 authentication processes, including accounts using MFA.

The joint action follows the 2024 LabHost disruption involving Europol and 19 countries. It shifts the focus from individual phishing campaigns to the shared kits and infrastructure that let many operators run targeted campaigns at scale.

First-order effects

Microsoft, Health-ISAC, Japanese authorities and their partners have interrupted access to a Chinese-language phishing-kit ecosystem used to send more than 1 billion malicious messages to over 75,000 organizations in 2026.
Customers and operators relying on the disrupted kits and infrastructure lose an operational channel for launching customized phishing campaigns.

Second-order effects

Other phishing-kit sellers and infrastructure providers face increased demand from displaced operators, while defenders must track replacement kits, domains and delivery infrastructure rather than treat the disruption as removal of the underlying threat.
The operation gives Microsoft and sector-sharing partners a concrete case for prioritizing takedowns of shared service layers, alongside organization-by-organization phishing defenses.

Third-order effects

Repeated action against service providers, from LabHost to this ecosystem, points to ecosystem cyber defense becoming a core model: cross-border authorities and private security firms target the suppliers that scale criminal activity.
If enforcement continues to reach marketplaces, kit operators and hosting infrastructure together, phishing operations may become more fragmented and costly to run, even as demand for reusable tools persists.

The trend: Phishing defense is moving beyond blocking individual lures toward coordinated disruption of the commercial infrastructure that industrializes them.

Discussion

@msftsecintel @msftsecintel on x
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. https://www.microsoft.com/...
@trmlabs @trmlabs on x
Since January 2026, three Chinese-language cybercrime services have enabled sending more than one billion malicious messages targeting over 75,000 organizations in more than 150 countries. Today, Microsoft and Health-ISAC, with support from organizations including TRM Labs, Resec…
@jgreigj Jon Greig on x
Microsoft used legal action to take down infrastructure behind three Chinese phishing services - YAM Store, CoGUI and Iron Man. The platforms provided cybercriminals with ready-made phishing sites that spoofed real government agencies, companies and more
@panopticonomy Laura Love on x
The Chinese MSS and their TNOC brothers are at it again.
@msftsecintel @msftsecintel on x
Threat actors purchased and used these tools and infrastructure to target organizations in various sectors in multiple countries. In collaboration with law enforcement agencies and other partners worldwide, Microsoft's Digital Crimes Unit (DCU) facilitated a disruption of the eco…
@cyber_rekk @cyber_rekk on x
More than 1 billion malicious messages were sent using a Chinese-language cybercrime ecosystem that Microsoft has been tracking And the people sending those messages didn't necessarily have to build the tools themselves Microsoft uncovered an interconnected marketplace where crim…
@msftsecintel @msftsecintel on x
Read our blog for a technical analysis of this Chinese-language phishing kit ecosystem, the shared infrastructure, provisioning methods, and downstream activity by threat actors using these tools, as well as protection and detection guidance for users and organizations.

Chronicles