Phishing kits fuel fake toll, delivery, and account notices

Microsoft says threat actors behind three phishing kits facilitated more than one billion emails and text messages since January 2026. Verify urgent requests through a known website or phone number instead of the message.

Who should care and what to do today

People who receive email or text messages should take extra care with notices about missing toll payments, traffic citations, deliveries, healthcare, financial services, or account checks. Microsoft’s reported targets included organizations in healthcare, financial services, wholesale distribution, and information technology in Japan, the United States, Australia, and India. Microsoft also says the attacks using these tools are common phishing attacks that could affect any organization.

To check a message, focus on the request rather than the logo. Does it demand quick payment, a sign-in, or a verification code? Open the service’s known website yourself, use its official app, or call a number from a bill or account statement. Do not use the link or phone number in the message.

Until the request is checked, do not reply, click, download an attachment, or enter information. If a work or organization account, password, or payment card was used after following a suspicious message, contact the account provider or financial institution through an official channel.

What Microsoft reported

Microsoft Threat Intelligence and the Microsoft Digital Crimes Unit described a Chinese-language criminal ecosystem made up of phishing kit operators and an underground marketplace. A phishing kit is a ready-made set of fake pages and tools used to collect information from people. Microsoft tracked the marketplace as Storm-3119 and the kit operators as Storm-2990.

Microsoft identified three kits sold through the marketplace: CoGUI, Haozi, and Iron Man System. The kits offered templates that copied trusted brands and organizations in many countries. Microsoft says the templates could collect usernames, passwords, payment card details, and sign-in verification codes.

Microsoft says threat actors behind the kits facilitated the sending of more than one billion phishing emails and text messages to more than 75,000 organizations since January 2026. The company says its Digital Crimes Unit worked with law enforcement agencies and other partners to disrupt the ecosystem’s primary developers and infrastructure.

The report does not identify a flaw in a consumer product. It describes an ecosystem that supplied phishing tools and infrastructure for campaigns impersonating government, transportation, healthcare, finance, retail, and technology services.

How the theft can happen

The messages described by Microsoft commonly create pressure. A recipient may be told that a payment is missing, an account needs a security check, or a fine must be handled quickly. A link then leads to a page designed to look like a familiar service.

If a person types a password, card number, or sign-in code into that page, the information can go to the criminal operating the kit. Microsoft says the kits could use fake CAPTCHA gates, which are “prove you are human” checks, and limit access to selected countries. These techniques can make analysis and detection harder.

Microsoft also observed device-code phishing. In this method, a victim is tricked into approving a sign-in for an application. That can give an attacker access to an account without the victim knowingly sharing a password.

Microsoft said downstream operators used stolen credentials and payment information for account access and fraudulent purchases. These are reported capabilities and observations from Microsoft’s investigation, not a claim that a particular reader or organization was targeted.

General guidance for safer handling

For personal accounts, use a passwordless sign-in option or multifactor authentication when the service offers it. Multifactor authentication is an extra approval, such as an app prompt or security key, after a password. It can reduce damage, but an unexpected approval request should still be denied.

For an organization, administrators can review sign-in alerts, make sure staff know how to report suspicious messages, and limit access to privileged accounts. A privileged account has broad control over systems or data. Microsoft also recommends reviewing email protections for organizations using its services.

If information was entered into a suspicious page, contact the account provider or financial institution through its known website or phone number. Change an exposed password through that official route, review recent account activity, and report the incident to the relevant administrator if an organization account was involved.

The practical check is simple: when a message creates urgency and asks for money, a password, or a sign-in code, pause and verify it outside the message. Do not return to the message for help.

Primary source

This article is based on Microsoft Security Blog, “The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime,” published October 14, 2026: https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/. The findings and observations described here are Microsoft's. Read the complete original source.

Article history: Published Oct 14, 2026 at 11:25 am EDT. Updates and corrections are noted here when material facts change.