Chinese Phishing Network Targets 75,000 Orgs With 1 Billion Messages

Key Takeaways

• A sophisticated Chinese-operated phishing-as-a-service (PhaaS) platform, “Iron Man System,” has been identified.
• This network is linked to generating an estimated one billion phishing messages targeting 75,000 organizations globally.
• The platform offers 2,360 pre-made phishing templates across 130 countries, significantly lowering the technical barrier for cybercriminals.
• Researchers uncovered shared infrastructure, including a publicly exposed Gitea server with code and container registries.
• While Microsoft has aided disruption efforts, recent activity indicates the operation remains ongoing.

Chinese Phishing Network Unleashes Billions of Messages Targeting Global Organizations

A vast, Chinese-managed phishing network has been implicated in the distribution of an estimated one billion phishing emails, impacting 75,000 organizations worldwide. This significant cyber threat was detailed in a report published on October 14, 2026.

The core of this operation is the “Iron Man System,” a commercial phishing platform that empowers threat actors to deploy convincing fake websites and harvest sensitive user data without needing to develop their own tools. This Phishing-as-a-Service (PhaaS) model democratizes sophisticated phishing capabilities for a wider range of malicious actors.

While the report highlights these alarming figures, it does not specify the exact timeframe or methodology used to calculate the one billion messages and 75,000 targeted entities. However, detailed findings reveal the network’s extensive toolkit, comprising 2,360 distinct phishing templates designed to impersonate various brands and services across 130 countries and regions. It is important to note that these figures represent the network’s potential reach and available resources, not confirmed breaches across all targeted organizations.

Unveiling the Iron Man System

Researchers from Resecurity identified and meticulously mapped the Iron Man System by purchasing a license and operating the software within a controlled laboratory environment. Their in-depth technical analysis characterized Iron Man as a comprehensive phishing kit rather than a traditional malware payload designed for installation on victim devices. The research team further infiltrated Chinese threat actor communities to gather intelligence on the developers and their collaborators.

The Iron Man System employs a Go backend and is delivered as a container image, enabling buyers to easily deploy the package on their own servers. Its control panel, featuring both Chinese and English interfaces, facilitates the management of fake web pages, brand impersonations, and license status. Resecurity researchers specifically examined version 6.3.1, which incorporated a subscription countdown and configured lures related to payment processing.

This commercialized approach significantly reduces the technical expertise required to launch extensive phishing campaigns. Prior investigations into Chinese-language phishing services have demonstrated how readily available templates and shared administrative panels streamline the process for criminals to target multiple countries simultaneously. While this broader trend provides context, it does not definitively link the operators of Iron Man to other, distinct services.

The platform’s extensive template library impersonates a wide array of entities, including courier services, financial institutions, tax agencies, retailers, telecommunications providers, and government bodies. DHL consistently appeared as the most impersonated brand, with 37 dedicated templates, followed by DPD with 24, and Apple with 23. The prevalence of delivery-related brands underscores the effectiveness of fake parcel notices as a common phishing tactic. Iron Man’s confirmed scope is notably broad, with its library containing 551 distinct lure-type tags, and updates as recent as October 1, 2026. This contrasts with similar kits like the Panda Shop smishing kit, which primarily focused on fake delivery and banking pages to steal financial information.

Exposed Infrastructure Reveals Shared Operations

During their investigation, researchers discovered a publicly accessible Gitea server hosting the kit’s source code and container registry. This exposure revealed 911 published image versions and eight registered accounts. Ongoing development was evident through recent releases, and matching project names directly linked the registry to the tested Iron Man package, ruling out the possibility of an unrelated mirror.

Analysis of the build settings exposed configurations for S3-compatible storage and a MariaDB database, both utilizing internal addresses. Static credentials were found across historical builds, though Resecurity opted to withhold their specific values. Code analysis further connected product catalogs and uploaded images to captured records containing details of selected goods and payment card fields.

This modular, reusable design mirrors the business model observed in the Darcula phishing service, where subscribers receive branded templates and continuous updates. However, the findings related to Iron Man do not establish any direct connection to Darcula’s messaging channels or shared development teams.

The laboratory panel used by Resecurity continuously checked its local license status approximately every 20 seconds, initiating server-side communication with the vendor’s authorization host. This dependency presents a critical opportunity for defenders: disrupting the central licensing service could impact numerous deployments simultaneously, offering a more efficient countermeasure than individually targeting each fake website.

Resecurity confirmed that Microsoft actively supported the broader operation, with its Digital Crimes Unit playing a role in disrupting the developers and associated infrastructure. Despite these efforts, recent builds indicate that Iron Man System remains active. While the report links infrastructure and accounts, it does not confirm the real-world identities of the operators, leaving attribution limited.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Implement Strong Email Security: Deploy advanced email filtering solutions capable of detecting and blocking sophisticated phishing attempts, including those impersonating major brands and services.
• Employee Training: Conduct regular, comprehensive cybersecurity awareness training for all employees, emphasizing how to identify phishing emails, suspicious links, and unexpected attachments.
• Multi-Factor Authentication (MFA): Enforce MFA across all critical accounts and services to significantly reduce the impact of compromised credentials.
• Monitor and Block IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems, firewalls, and intrusion detection/prevention systems to identify and block communication with known malicious infrastructure.
• Incident Response Plan: Ensure your organization has a well-defined and rehearsed incident response plan for handling phishing incidents and potential data breaches.
• Regular Software Updates: Keep all operating systems, applications, and security software updated to patch known vulnerabilities that threat actors might exploit.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.