Loading malware…
Iron Man is a subscription-based phishing-kit-as-a-service platform used for credential theft, payment-card harvesting, and impersonation fraud. It belongs to a Chinese-language cybercrime ecosystem supported by the YAM Store infrastructure marketplace. Microsoft collectively tracks Iron Man, CoGUI, and Haozi as Storm-2990 and attributes their development to Chinese-speaking threat actors. Iron Man increasingly replaced CoGUI in this ecosystem by mid-2026.
The platform offers more than 2,300 impersonation templates tailored to brands, industries, and countries worldwide. These templates support email, SMS, and web-based campaigns impersonating banks, retailers, healthcare providers, delivery services, telecommunications companies, and government authorities. Common lures include delivery problems, unpaid tolls, traffic penalties, and account-verification requests. A payment-card capture module collects card numbers, expiration dates, and security codes. The phishing platforms support interactive credential harvesting, allowing operators to monitor victims and request one-time verification codes, while geofencing, IP filtering, and fake CAPTCHA gates obstruct automated analysis.
Iron Man requires recurring contact with its vendor's licensing server, creating a shared operational dependency across deployments. In 2026, Microsoft and Health-ISAC obtained a U.S. court order to seize and redirect domains supporting Iron Man, CoGUI, and YAM Store as part of a coordinated disruption with Japanese authorities and industry partners.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.