Microsoft and Health-ISAC, working alongside the Japan Cybercrime Control Center (JC3) and a group of private-sector security firms, have disrupted three phishing-as-a-service (PhaaS) platforms the coalition says are behind more than one billion scam messages sent since January 2026.
The three kits dismantled in the operation are CoGUI (also tracked as NX or FA), Haozi (also known as Phoenix), and Iron Man System. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs were named as participating companies alongside the announcement's lead partners.
A coalition built around APAC victimology
What stands out about this operation is less the headline number than its structure. Rather than a single vendor acting on its own infrastructure, the effort pairs a cloud platform holder (Microsoft) with a sector-specific ISAC, a national cybercrime coordination body in Japan, and a spread of firms that between them cover domain registration, email security, network edge services, and blockchain intelligence.
JC3's involvement points to Japan as a primary target geography for these kits — a reasonable inference given the centre's remit, though the announcement itself does not break out victim counts by country. The Health-ISAC's participation, meanwhile, underscores that PhaaS operators do not restrict themselves to consumer lures; credential-harvesting kits are routinely pointed at healthcare organisations, where phishing remains a persistent initial-access vector.
The scale figure is worth reading carefully. The one-billion-plus number refers to scam messages attributed to these kits since the start of 2026, not to confirmed victims or compromised accounts. PhaaS economics reward volume: kits are sold or rented on subscription, and operators blast messages indiscriminately, knowing that a fraction-of-a-percent conversion rate is enough to sustain the business.
What these kits actually do
CoGUI, Haozi and Iron Man System belong to the same broad family of tooling: turnkey phishing pages, often fronted by lookalike domains, that capture usernames, passwords and one-time codes, frequently relayed to the operator in real time so a human can complete the login before the victim notices anything wrong. Because the interception is live, a stolen OTP is enough to defeat conventional second-factor protections.
That mechanic is the practical takeaway for defenders. A phishing-resistant factor — a FIDO2 or passkey-based login that binds the credential to the legitimate domain — neutralises the real-time relay model these kits are built around. Where that is not yet feasible, treating any prompt that asks for a password and an OTP on an unfamiliar page as hostile by default is the single highest-value habit for end users.
Detection and response guidance for APAC teams
For security teams in Hong Kong and across the region, several steps follow from how these kits operate:
- Verify at the domain level. Lookalike registration is the kit operator's cheapest step and therefore the most reliable tell. Check the registered domain, not just the page branding, before entering credentials on any unsolicited link.
- Treat combined credential-plus-OTP prompts on unsolicited pages as attacks, regardless of how legitimate the branding appears.
- Prefer phishing-resistant MFA (FIDO2/passkeys) for administrative, finance and healthcare-adjacent accounts first — the highest-yield targets for kit operators.
- Report, don't merely delete. Suspicious messages and domains should be forwarded to the relevant authorities rather than quietly discarded. In Hong Kong, reporting channels include HKCERT and the CyberDefender platform; regionally, sector ISACs and national coordination centres feed the kind of intelligence that made this operation possible.
The durability question
It is worth being clear-eyed about what takedowns deliver. Disrupting a PhaaS operation buys defenders a window; it does not close the threat. Kits are modular, code is shared and resold, and successor platforms typically appear within months, often reusing the same page templates and lures. The operators behind CoGUI, Haozi and Iron Man System invested in subscription infrastructure precisely because it is easy to rebuild.
The durable value of operations like this one is therefore not the takedown itself but the intelligence-sharing model behind it: a national coordination centre, a sector ISAC, a platform holder and competing vendors working from a common picture. For organisations in APAC — where multilingual, high-volume phishing remains a daily operational reality — that model, and the defensive habits above, will outlast any single kit.
微軟與 Health-ISAC 聯同日本網絡罪案控制中心（JC3）及多家私營網絡安全公司，成功瓦解三個「釣魚即服務」（PhaaS）平台。該聯盟表示，自 2026 年 1 月以來，這些平台已發出超過十億條詐騙訊息。
本次行動中被搗破的三個工具包分別為 CoGUI（亦被標記為 NX 或 FA）、Haozi（又稱 Phoenix）以及 Iron Man System。Resecurity、Cloudflare、Oracle、Proofpoint 與 TRM Labs 均被列為參與公司，與公告的主要發起方共同行動。
以亞太地區受害情況為核心的聯盟
這次行動真正值得注意的，與其說是驚人的數字，不如說是參與方的結構。此次行動並非單一廠商在自家基礎設施上獨力完成，而是結合了雲端平台持有者（Microsoft）、一個行業級 ISAC、日本國家網絡罪案協調機構，以及在域名註冊、電郵安全、網絡邊緣服務和區塊鏈情報等領域各有專長的多家企業。
JC3 的參與暗示日本是這些工具包的主要目標地區——這是一個合理的推斷，考慮到該中心的職責範圍，但公告本身並未按國家劃分受害者數字。Health-ISAC 的參與則說明，PhaaS 營運者並不限於針對消費者；憑證收割工具包經常被用來攻擊醫療機構，釣魚仍是該行業長期存在的初始入侵途徑。
關於規模數字需要仔細解讀。「十億以上」指的是自 2026 年初以來歸因於這些工具包的詐騙訊息數量，而非確認的受害者人數或被入侵帳戶數。PhaaS 的商業模式以量取勝：工具包以訂閱方式出售或出租，營運者不加選擇地大量發放訊息，因為哪怕千分之幾的轉化率已足以維持這門生意。
這些工具包實際上如何運作
CoGUI、Haozi 和 Iron Man System 屬於同一類型的工具：開箱即用的釣魚頁面，通常配合仿冒域名，用以擷取用戶名稱、密碼和一次性密碼（OTP），並經常即時轉發給營運者，以便在受害者察覺異常前由真人完成登入。由於攔截是即時進行的，被竊取的 OTP 足以突破傳統的第二重驗證保護。
這個機制正是防禦者需要掌握的關鍵。以 FIDO2 或 passkey 為基礎、將憑證綁定至合法域名的防釣魚驗證因子，可以從結構上化解這些工具包所依賴的即時轉發模式。在尚未能全面部署的情況下，對任何在陌生頁面上同時要求輸入密碼 及 OTP 的提示保持預設敵意，是終端用戶最有價值的單一行為習慣。
亞太團隊的偵測與應對指引
對於香港及整個地區的網絡安全團隊而言，可從這些工具包的運作方式中得出以下幾項措施：
- 從域名層級進行核實。 仿冒域名註冊是工具包營運者成本最低的一步，因此也是最可靠的破綻。在任何非主動要求的連結上輸入憑證前，應先檢查實際註冊域名，而不只是頁面的品牌外觀。
- 將非主動要求頁面上同時要求憑證和 OTP 的提示一律視為攻擊，不論其品牌外觀多麼逼真。
- 優先為行政、財務及醫療相關帳戶部署防釣魚 MFA（FIDO2／passkeys）——這些是工具包營運者眼中回報最高的目標。
- 舉報，而非僅僅刪除。 可疑的訊息和域名應轉發至相關當局，而非靜靜丟棄。在香港，舉報渠道包括 HKCERT 及 CyberDefender 平台；在地區層面，行業級 ISAC 和各國協調中心所形成的即時情報共享，正是促成此次行動的關鍵。
可持續性的問題
我們需要清醒地認識搗破行動能帶來什麼。瓦解一個 PhaaS 營運網絡為防禦者爭取了一段時間窗口，但並未消除威脅。工具包採模組化設計，代碼會被共享和轉售，後繼平台通常在數月內就會冒現，往往沿用相同的頁面模板和釣魚誘餌。CoGUI、Haozi 和 Iron Man System 的營運者投資於訂閱式基礎設施，正是因為重建成本極低。
因此，此類行動的持久價值不在於搗破本身，而在於背後的即時情報共享模式：國家級協調中心、行業 ISAC、平台持有者，以及彼此為競爭對手的廠商，共享同一份情報圖景。對於亞太地區的機構——多語言、大批量的釣魚攻擊是每日營運的常態——這套模式及上述防禦習慣，將比任何單一工具包更為長久。