Security researchers have mapped out a large Chinese-run phishing-as-a-service operation connected to roughly one billion phishing emails sent against some 75,000 organizations worldwide. The findings, published October 14, center on a commercial toolkit called Iron Man System that sells ready-made phishing infrastructure to anyone willing to pay a license fee.

Phishing Packaged as a Product

Rather than building their own fake websites and data-collection tools, criminals using Iron Man System simply rent access to an existing platform. Researchers at Resecurity purchased a license and ran the software in an isolated lab to study it directly, then went further — embedding themselves in Chinese-language criminal communities to learn more about who builds and maintains the kit.

What they found is a surprisingly polished piece of software. Iron Man runs on a Go-based backend, ships as a container image buyers can deploy on their own infrastructure, and is managed through a bilingual Chinese-English control panel that handles fake-page templates, brand configuration, and license status. The version Resecurity tested, 6.3.1, even displayed a subscription countdown timer, complete with payment-related prompts — phishing crime, run with the trappings of a legitimate SaaS product.

A Template Library Built for Scale

The kit’s real value to criminals is its content library: 2,360 phishing templates covering 130 countries and regions, tagged with 551 distinct lure categories and updated as recently as October 1. The templates impersonate the brands people trust and interact with daily — couriers, banks, tax authorities, retailers, and telecom providers.

Delivery and shipping brands dominate the collection, reflecting just how effective a fake “package on the way” notification remains as bait:

• DHL — 37 distinct templates, the largest count of any single brand
• DPD — 24 templates
• Apple — 23 templates

The approach mirrors tactics seen in other recent kits, including the Panda Shop smishing toolkit, which similarly leaned on fake delivery and banking pages to harvest financial details.

A Mistake That Exposed the Infrastructure

Resecurity’s investigation got an unexpected boost when it located a publicly accessible Gitea server hosting the kit’s source code and container registry — left exposed with 911 published image versions and eight registered developer accounts. Build configurations on that server revealed S3-compatible storage and a MariaDB database running on internal addresses, along with static credentials embedded across historical builds (Resecurity has withheld the actual credential values from its public report).

Code analysis also tied product catalogs and uploaded images on the registry to captured phishing records containing stolen payment-card data, directly linking the exposed development infrastructure to real victim data collected through the kit.

A Centralized Weak Point

One detail stands out for defenders: every deployed instance of Iron Man checks in with its licensing server roughly every 20 seconds to verify it’s still authorized to run. That constant dependency on a central authorization host is also a potential kill switch — disrupting the licensing service could disable many deployments simultaneously, rather than requiring takedown action against each individual phishing site one at a time.

Resecurity credits Microsoft, through its Digital Crimes Unit, with leading a broader disruption effort against the operation’s developers and infrastructure. Even so, the research notes that recent builds show continued development activity, suggesting the operators haven’t been fully shut down. Attribution remains limited to infrastructure and account identifiers rather than confirmed real-world identities.

What Organizations Can Do

Given the sheer scale of this campaign, security teams should treat brand-impersonation phishing as an ongoing, industrialized threat rather than a one-off nuisance:

• Train employees to scrutinize delivery, banking, and tax-related emails specifically, since these are the most heavily templated lures.
• Deploy email filtering and anti-phishing controls capable of detecting lookalike domains and newly registered infrastructure.
• Monitor for the indicators of compromise Resecurity published, including the licensing and registry domains tied to the operation.
• Report suspected brand impersonation to the affected companies, since courier and retail brands are often unaware their identity is being used at this scale.

Iron Man System is a clear illustration of how far phishing has moved from improvised scams toward packaged, subscription-based crimeware — and why disrupting the platforms themselves, not just the sites they generate, has become a priority for both researchers and law enforcement.