Microsoft, with Japanese authorities, Health-ISAC and industry partners, disrupted a Chinese-language phishing infrastructure ecosystem built around kits including CoGUI, Haozi and Iron Man System sold through the YAM Store marketplace — a cluster Microsoft tracks in part as Storm-2990 — which since January 2026 has facilitated more than one billion phishing emails and SMS messages to over 75,000 organisations worldwide, harvesting credentials and financial data and abusing the device-code authentication flow to obtain tokens for compromised accounts. The takedown is one of the largest phishing-infrastructure disruptions of the year. Australian organisations should review registry dependency hygiene, block the flagged packages and watch for the same autopublish pattern in their own mirrors.

• Source article