Loading malware…
Iron Man System is a commercial phishing-as-a-service kit sold to criminal customers as a self-hosted, container-distributed package. It provides thousands of localized templates impersonating banks, postal and courier services, government agencies, traffic authorities, healthcare providers, telecommunications companies, and retailers. Campaigns use email and SMS lures, including unpaid tolls, traffic fines, parcel-delivery problems, and account-verification requests, to direct victims to fraudulent websites and steal credentials, payment-card information, and verification codes. Its geographic coverage includes the United States, Japan, Australia, and India.
The platform uses a Go backend built with GoFrame and offers a bilingual Chinese-English administration interface. WebSocket communications transmit victim submissions, while Telegram notifications and interactive controls allow operators to monitor victim progress and determine subsequent phishing screens. Geographic restrictions, fake CAPTCHA gates, IP-based filtering, and anti-analysis settings obstruct automated inspection and security research. Subscription licensing requires recurring authorization through vendor-operated infrastructure.
Iron Man System is associated with Chinese-speaking cybercriminal developers collectively tracked by Microsoft as Storm-2990, alongside the developers of CoGUI and Haozi. It is sold through YAM Store, a separate marketplace tracked as Storm-3119 that supplies compromised or fraudulently obtained cloud resources for phishing operations. Microsoft, Health-ISAC, law enforcement, and industry partners coordinated disruption of infrastructure supporting this ecosystem in October 2026.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers said the Iron Man System includes more than "2,335 templates tailored to over 139 countries including Australia, Japan, India, and the United States, with the United States accounting for the most phishing templates."
Yam Store sells fraudulently obtained or compromised Microsoft and Google domains as well as offering three phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System.
Iron Man System est un kit PhaaS vendu à des acheteurs criminels sous forme de package auto-hébergé.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
“T1583.001 — Acquire Infrastructure: Domains (Resource Development)” and “L’infrastructure se décompose en cinq familles de domaines”.
“T1583.004 — Acquire Infrastructure: Server (Resource Development)” and “Un backend en Go, distribué via une registry de conteneurs auto-hébergée”.
“T1608.005 — Stage Capabilities: Link Target (Resource Development)” and “2 360 templates de pages d’hameçonnage”.
“T1566.002 — Phishing: Spearphishing Link (Initial Access)” and “75 000 organisations ciblées, 1 milliard d’emails de phishing”.
“2 360 templates de pages d’hameçonnage impersonnant des services postaux, douaniers, fiscaux, bancaires, télécom et programmes de fidélité dans 130 pays” and “T1036 — Masquerading (Defense Evasion)”.
“Les soumissions victimes capturent simultanément des données de carte bancaire (cardData.cardNumber) et des sélections de produits (SelectGoods).”
“Les soumissions victimes capturent simultanément des données de carte bancaire (cardData.cardNumber) et des sélections de produits (SelectGoods).”
“T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)” and “vérification régulière (toutes les ~20 secondes) auprès d’un backend opérateur”.
“T1102 — Web Service (Command and Control)” and “endpoint de télémétrie/logging (log2)”.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.