[CLSTR]
< Back to all clusters
[TECHNOLOGY] · United States, Japan, Australia, Germany, United Kingdom · 2 sources

started · updated

Part of situation: Microsoft 365 phishing and MFA bypass threats (13 clusters)

Microsoft disrupts global phishing network sending 1 billion messages

Microsoft phishing kits cybersecurity cybercrime credential theft

Microsoft, in collaboration with international cybersecurity entities, has dismantled a massive phishing network responsible for sending over 1 billion fraudulent messages. The operation targeted three specific phishing kits: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and the Iron Man System.

These kits allowed criminals to deploy ready-made fraudulent websites and messages to steal passwords, payment information, and authentication codes. The attackers utilized cryptocurrency to facilitate payments, adding a layer of anonymity to their operations. The scammers primarily communicated in Chinese, which presented challenges for non-speaking investigators.

Of the total messages sent, 750 million were directed at Microsoft customers. The campaign targeted over 75,000 organizations globally, with the United States and Japan among the most affected countries. Other impacted nations included Australia, Germany, the United Kingdom, Canada, and Brazil. The phishing attempts often mimicked legitimate services, such as Amazon or various government websites, to create a false sense of urgency.

Entities

CoGUI · Haozi · Iron Man System · Japan Cybercrime Control Center · Microsoft

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Microsoft trava 3 kits de phishing usados em burlas [www.maistecnologia.com]
Microsoft derruba rede de phishing que aceitava criptomoedas e enviou mais de 1 bilhão de mensagens [livecoins.com.br]