Microsoft, working with Health-ISAC, the Japan Cybercrime Control Center and several private-sector partners, has announced action against three phishing kits identified as CoGUI, Haozi and Iron Man System. According to Microsoft and the participating organisations, these kits were used in large-scale scam activity and linked to more than one billion scam messages sent since January 2026.

While takedowns can disrupt criminal infrastructure, they do not remove the broader business risk. For European companies, the development is a reminder that phishing toolkits have become industrialised, making it easier for attackers to launch convincing campaigns against employees, customers and suppliers.

What happened

Microsoft and its partners said they disrupted infrastructure associated with three phishing kits that have allegedly supported high-volume scam operations. The named kits are CoGUI, also referred to as NX or FA, Haozi, also referred to as Phoenix, and Iron Man System.

Based on the source report, the action involved collaboration between technology providers, sector bodies and cybercrime-focused organisations. Such operations typically aim to seize or block malicious domains, hosting resources or related services used to run phishing campaigns. The source material does not provide enough detail to independently confirm the full scope or long-term effect of the disruption.

Why it matters for European businesses

Phishing remains one of the most common entry points for fraud, account compromise and ransomware. Kits of this kind lower the barrier to entry for attackers by packaging phishing pages, credential capture workflows and campaign management tools into reusable services. That means even less sophisticated criminals can run convincing attacks at scale.

For European businesses, the practical risk goes beyond spam volume. Stolen credentials can lead to unauthorised access to Microsoft 365, email accounts, cloud services, payment systems and internal admin tools. A single compromised account can trigger invoice fraud, business email compromise, customer-data exposure or lateral movement into wider IT systems.

The case is also relevant for organisations with cross-border operations, supplier networks or healthcare links, given the involvement of Health-ISAC and international partners. Businesses should view this as part of a broader trend: phishing infrastructure is global, fast-moving and often rebuilt quickly after enforcement or takedown actions.

Who may be affected

• SMEs and founders
  Smaller organisations are frequent targets because they may have fewer dedicated security controls and leaner IT resources.
• IT and security teams
  Teams managing Microsoft 365, cloud identity and email security are directly exposed to credential phishing risk.
• Finance and operations staff
  Employees handling invoices, payments and supplier communication are often targeted by scam campaigns.
• E-commerce and digital businesses
  Customer support, admin portals and third-party SaaS accounts can be attractive targets for account takeover.
• Regulated sectors
  Healthcare, finance and other regulated organisations face added operational and compliance consequences if phishing leads to data or system compromise.

What companies should consider

• Review phishing-resistant authentication
  Use strong multi-factor authentication across email, cloud platforms and admin accounts. Prioritise phishing-resistant methods where possible for higher-risk users.
• Harden Microsoft 365 and identity controls
  Audit conditional access, sign-in monitoring, mailbox forwarding rules and privileged account protections.
• Improve email and domain protection
  Check that SPF, DKIM and DMARC are correctly configured, and ensure advanced email filtering is enabled for malicious links and attachments.
• Train staff on current phishing techniques
  Awareness programmes should cover fake login pages, urgent payment requests, MFA fatigue and supplier impersonation.
• Prepare for account compromise incidents
  Have clear procedures for credential resets, session revocation, mailbox review and communication with affected customers or partners.
• Monitor third-party exposure
  Review supplier and SaaS access paths, especially where external accounts can reach shared documents, payment workflows or customer data.

Although this disruption may reduce some immediate threat activity, European businesses should not assume the risk has passed. Phishing kits are often replaced, rebranded or copied quickly, so the most effective response remains stronger identity security, better monitoring and regular employee training.