Loading malware…
Haozi, also known as Phoenix, is a commercially licensed phishing-as-a-service kit used for credential theft and financial fraud. It is sold through YAM Store, an underground marketplace tracked by Microsoft as Storm-3119. Microsoft collectively tracks the developers and associated activity behind Haozi, CoGUI, and Iron Man System as Storm-2990 and attributes their development to Chinese-speaking threat actors.
Haozi belongs to a group of interactive phishing kits that impersonate trusted organizations to harvest usernames, passwords, payment information, and verification codes. The kits support real-time victim monitoring, Telegram notifications, and operator control over subsequent phishing screens. Their anti-analysis features include varying combinations of geographic restrictions, IP filtering, fake CAPTCHA gates, and other detection-evasion settings. Operators distribute phishing lures through email and SMS.
The associated ecosystem uses compromised or fraudulently obtained Microsoft and Google cloud resources supplied by YAM Store. Campaigns using its tools have targeted consumers and organizations worldwide, including healthcare, financial services, wholesale distribution, and information technology organizations in Japan, the United States, Australia, and India.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft and cybersecurity vendor Resecurity identified three phishing kits through the Yam Store, including CoGUI, Haozi (also known as Phoenix), and Iron Man System.
Yam Store sells fraudulently obtained or compromised Microsoft and Google domains as well as offering three phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.