Iron Man Phishing Kit Impersonates Global Banks and Agencies

Security researchers from Resecurity and Microsoft analyzed the Iron Man phishing-as-a-service platform, which supplies criminals with ready-made websites impersonating trusted organizations. The platform facilitates large-scale credential theft by offering customizable frontends for banks, couriers, tax agencies, and traffic authorities. This report outlines the technical architecture and detection indicators for security operations teams monitoring similar threats.

Root cause

The Iron Man system operates as a commercial service, providing buyers with self-hosted packages built on a Go backend. It ships as a containerized application, allowing operators to deploy infrastructure quickly. The administration panel supports both Chinese and English, enabling users to manage separate phishing frontends linked to specific impersonated brands. This modular design simplifies the creation of convincing fraud campaigns without requiring advanced coding skills from the attacker.

Attack path

Operators use the platform to collect sensitive data through WebSocket connections, sending real-time notifications via Telegram when victims enter credentials or verification codes. Microsoft’s investigation highlights that operators can manually control subsequent screens, transforming static impersonation pages into interactive fraud sessions. The kit also includes geofencing, fake CAPTCHA gates, and IP filtering to restrict researcher access and complicate automated inspection of the malicious infrastructure.

Affected versions

• Version 6.3.1 was observed in an isolated laboratory deployment by researchers.
• The platform includes a subscription countdown feature visible in the administration panel.
• An older configuration referenced api2.haoyutai.cc, but researchers identified this address as inactive.

Mitigation

• Monitor network traffic for connections to known phishing infrastructure domains.
• Implement strict DNS filtering to block access to suspicious authorization backends.
• Enforce multi-factor authentication to mitigate the impact of stolen credentials.
• Review proxy logs for unusual WebSocket connections that may indicate data exfiltration.

Detection notes

Teams usually detect this type of activity by monitoring for outbound connections to unfamiliar WebSocket endpoints, which often signal real-time data exfiltration. Check whether users are accessing domains with recently registered or suspicious TLDs that mimic legitimate services. Look for alerts related to fake CAPTCHA interactions or unusual geolocation patterns in web traffic. Containment moves should include isolating affected endpoints and blocking traffic to identified command-and-control domains to prevent further credential theft.

Background: Phishing

Phishing tricks you into taking action by disguising malicious intent as legitimate communication. You stop it by verifying sources, using passkeys, and treating every unsolicited request as suspicious until proven otherwise. Technical controls like email authentication and network segmentation reduce risk but cannot eliminate human error.

Read the full guide: Phishing Defenses: Answers to 10 Critical Questions

What to do and how to stay safe: Iron Man

• Verify that your organization’s web proxies block known phishing-as-a-service infrastructure domains.
• Train staff to recognize interactive phishing pages that request additional verification steps.
• Monitor for Telegram bot activity or unusual WebSocket connections in your network logs.
• Ensure multi-factor authentication is enforced across all critical accounts to limit credential abuse.

Step-by-step guide: Detect Phishing Infrastructure: Signals, Blind Spots and Tools

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is behind the Iron Man phishing platform?

Microsoft tracks the developers of Iron Man, CoGUI, and Haozi collectively as the threat actor group Storm-2990.

How many countries are affected by these phishing templates?

Resecurity identified templates across 130 countries and regions, while Microsoft described broader coverage.

Is the api2.peaceman.cc domain still active?

Resecurity confirmed api2.peaceman.cc as the primary authorization backend through network observations and configuration analysis.