Skip to content
Disruption of Chinese Phishing Kits Targeting Global Organizations

Disruption of Chinese Phishing Kits Targeting Global Organizations

First seen 14 Oct 2026, 14:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 17:35 UTC
  • •The 'Iron Man System' phishing operation has been disrupted, affecting global organizations.
  • •Over 2,360 phishing templates were identified, targeting various sectors worldwide.
  • •Collaboration among Microsoft, Resecurity, and other partners led to the takedown of key phishing infrastructure.

Resecurity and Proofpoint reported a significant disruption of a phishing-as-a-service (PhaaS) operation known as the 'Iron Man System,' which sold phishing kits targeting various sectors, including finance and government. The operation, linked to Chinese threat actors, utilized over 2,360 phishing templates across 130 countries. The disruption involved collaboration with Microsoft and other partners, leading to the takedown of key infrastructure supporting these phishing campaigns. Additionally, phishing kits named CoGUI, CoAceV, and CoFish_Ws were identified as major threats, particularly targeting Japanese organizations. The operation's impact is expected to cause operational and financial damage to the involved threat actors. The current status indicates ongoing efforts to dismantle the ecosystem behind these phishing kits.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
Disruption of Iron Man phishing operation
Resecurity and Proofpoint reported the takedown of the Iron Man System, a major phishing-as-a-service operation linked to Chinese threat actors.
Resecurity
2026-10-14
Proofpoint identifies major phishing kits
Proofpoint reported on phishing kits CoGUI, CoAceV, and CoFish_Ws, which target Japanese organizations and are part of the disrupted ecosystem.
Proofpoint

More articles in this cluster (7)

Following this threat?

Track CoAceV and Microsoft in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3

Common questions

What organizations are affected?
The phishing kits targeted various sectors globally, including finance, government, and healthcare.
What is the current status of the disruption?
The disruption has been confirmed, and ongoing efforts are in place to dismantle the associated phishing infrastructure.
How can organizations protect themselves?
Organizations should enhance their email security measures and monitor for phishing attempts, especially those impersonating known brands.