Microsoft Disrupts Three Phishing Kits Behind Massive Scam Campaigns

Phishing attacks are becoming easier for cybercriminals to launch with ready-made tools that imitate trusted brands and steal sensitive information. On October 14, 2026, Microsoft announced action against three phishing kits known as CoGUI, Haozi and Iron Man System, which were reportedly sold through an underground marketplace.

According to figures shared by Microsoft and its partners, these kits were linked to more than one billion phishing emails and SMS messages since January 2026, targeting over 75,000 organisations. The campaign reportedly involved around 17,000 unique domains. These figures come from the organisations involved in the disruption and have not been independently verified here.

The phishing kits enabled criminals to create convincing fake login and payment pages that captured victims’ credentials and financial details. Some campaigns used fake CAPTCHA checks to evade security scanners, while attackers could monitor victims’ activity in real time. The report also identifies India among the countries where organisations were targeted, with the Iron Man System reportedly offering templates designed for Indian users. No specific number of Indian victims was provided.

For individuals and businesses, these attacks highlight the importance of checking unexpected emails and SMS messages before clicking links. Scammers may imitate delivery services, banks, shopping platforms or workplace login pages. Always access accounts through official apps or manually entered website addresses, verify URLs before entering credentials, enable multi-factor authentication and never share OTPs or PINs. Businesses should also monitor suspicious sign-ins and strengthen email security. If a phishing incident leads to financial loss in India, report it promptly through 1930 or the National Cyber Crime Reporting Portal at cybercrime.gov.in.

Phishing campaigns show why safe browsing habits should be supported by reliable security software. Net Protector’s Total Security includes phishing and ad-blocking protection, according to its product information. Users can explore its security features at npav.net to understand which protections best suit their devices.