A Chinese-run phishing network has been linked to one billion phishing emails targeting 75,000 organizations, according to a report published on October 14, 2026.
The operation centers on Iron Man System, a paid phishing platform that lets criminals deploy fake websites and collect sensitive information without building their own tools.
The report lists those headline figures but does not explain their measurement period or counting method. Its detailed findings document 2,360 phishing templates covering 130 countries and areas.
These numbers describe the network’s reported reach and available tools, not confirmed breaches at every targeted organization.
Researchers from Resecurity identified and mapped the operation after buying a license and running the software in an isolated lab.
Their technical investigation into Iron Man describes a phishing kit rather than malware installed on victims’ devices. The team also entered communities managed by Chinese threat actors to investigate its developers and associates.
Chinese Phishing Network Linked to 1 Billion Messages
Iron Man System uses a Go backend and arrives as a container image, allowing buyers to run the package on their own servers.
Its Chinese-English control panel manages fake pages, brand settings, and license status. Researchers tested version 6.3.1, which displayed a subscription countdown and configured payment-related lures.
This commercial model lowers the skill needed to run phishing campaigns. Earlier reporting on Chinese language phishing services explains how ready-made templates and shared panels help criminals target several countries at once.
That wider trend provides context, but does not establish that separate services share Iron Man’s operators. The template library impersonated couriers, banks, tax agencies, retailers, telecom providers, and public bodies.
DHL had the largest individual template count, with 37, followed by DPD with 24 and Apple with 23. Delivery-related brands formed the largest category, reflecting the appeal of familiar parcel notices as phishing bait.
Comparable tactics appeared in the Panda Shop smishing kit, which used fake delivery and banking pages to collect financial information. Iron Man’s confirmed scope is distinct: its library included 551 lure-type tags, with entries updated as recently as October 1, 2026.
Exposed Builds Reveal Shared Infrastructure
Researchers found a publicly accessible Gitea server holding the kit’s code and container registry. It exposed 911 published image versions and eight registered accounts. Recent releases showed continued development, while matching project names tied the registry directly to the tested package rather than an unrelated mirror.
Build settings revealed S3-compatible storage and a MariaDB database configured on internal addresses. Static credentials appeared across historical builds, although Resecurity withheld their values.
Code analysis also linked product catalogs and uploaded images to captured records containing selected goods and payment-card fields.
.webp)
The reusable design resembles the business approach described in the Darcula phishing service report, where subscribers receive branded templates and ongoing updates. However, the Iron Man findings do not establish that it uses Darcula’s messaging channels or shares its developers.
The lab panel checked its local license status roughly every 20 seconds, triggering server-side contact with the vendor’s authorization host.
This dependency offers defenders a central disruption point: disabling the licensing service could affect many deployments together instead of requiring separate action against each fake website.
Resecurity said Microsoft led the wider operation and its Digital Crimes Unit helped disrupt developers and infrastructure. Still, recent builds indicated ongoing activity. Attribution remains limited: the report links infrastructure and accounts, but confirms no operator’s real-world identity.
Indicators of compromise (IoCs):-
| Type | Indicator | Role or qualification |
|---|---|---|
| Domain | api2[.]peaceman[.]cc | Confirmed licensing backend |
| Domain | ipapi2[.]peaceman[.]cc | Auxiliary API |
| Domain | bin2[.]peaceman[.]cc | Auxiliary API |
| Domain | log2[.]peaceloving[.]xyz | Telemetry and logging |
| Domain | ossapi[.]haoeryu[.]top | Object storage |
| Domain | docker[.]aidchildren[.]cc | Gitea build registry |
| Domain | docker[.]loveboy[.]xyz | Alternate registry hostname |
| Domain | install[.]loveboy[.]xyz | Deployment console |
| Domain | api2[.]haoyutai[.]cc | Retired configuration value |
| IP address | 104[.]26[.]8[.]8 | Observed CDN fronting address |
| IP address | 172[.]67[.]149[.]149 | Observed logging CDN address |
| IP address | 194[.]233[.]80[.]219 | Research lab; not attacker infrastructure |
| Account email | aidchildren[@]mail[.]com | Registry account: admin |
| Account email | bsn[@]qq[.]com | Registry account: bsn |
| Account email | sgkj7856[@]gmail[.]com | Registry account: sg6688 |
| Account email | 1253261414[@]qq[.]com | Registry account: Po |
| Account email | fackyouhaozi[@]qq[.]com | Registry account: fackyouhaozi |
| Account email | kubile[@]gmail[.]com | Registry account: kubile |
| Account email | j6745g[@]protonmail[.]me | Registry account: jerry |
| Account email | wfd4as567[@]gmail[.]com | Registry account: wfd4as567 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
