Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced Wednesday.

Since the start of the year, a vast collection of customized phishing kits developed and sold by Chinese-speaking threat actors — a cluster Microsoft tracks as Storm-2990 — have delivered more than 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. More than three-quarters of those malicious messages targeted Microsoft customers, the company said.

Cybercriminals purchased the phishing kits, tools and infrastructure from an interconnected network Microsoft and Japanese authorities started investigating in early 2025. The kits were used to target individuals and organizations in healthcare, financial services, logistics and IT predominantly in the United States and Japan.

Microsoft said it and Health-ISAC, working with a federal court order, seized and redirected domains that powered the underlying infrastructure of these cybercrime tools and services known as YAM Store, CoGUI and Iron Man. 

The company said it also disabled more than 20,000 accounts connected to YAM Store and continues to disrupt the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.

“Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue. The details may change, but the goal is the same: to get someone to click, share personal information, or pay,” Steven Masada, general counsel and general manager of Microsoft’s Digital Crimes Unit, wrote in a blog post.

“These messages are relentless,” he added. “Delete and block one, and another takes its place. Ignore them, and more will follow. Fall for one, and the floodgates open. What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”

The phishing kids included templates impersonating legitimate brands that cybercriminals used to facilitate high-volume campaigns. Researchers said similar infrastructure and overlapping activity suggested the tools shared development origins, code reuse or close collaboration among developers.

Microsoft said cybercriminals used the phishing kits to steal credentials, financial data and abuse the device code authentication process to obtain authentication tokens and access compromised accounts. Researchers said cybercriminals primarily used the tools for financial fraud, typically using stolen payment data to make fraudulent purchases of high-end goods or transactions on legitimate financial platforms. 

Resecurity, which aided the investigation, gained access to Iron Man’s infrastructure and found 2,360 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries. Cloudflare, Oracle, Proofpoint and TRM Labs also provided research and investigative support.

“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world,” Masada wrote. 

“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” he added. “The scam message is often the only part victims see. The businesses behind it are what make it possible.”

The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.

McKesson said its business and distribution centers remain operational in the wake of a cyberattack it disclosed Friday that resulted in data theft and temporary service interruptions.

Attackers gained access to some of the health care vendor’s third-party applications and stole data associated with a subset of customers in the company’s oncology, multispecialty and medical-surgical business units, Francisco Fraga, chief information and technology officer at McKesson, said in a statement Saturday. 

McKesson is a major player in the healthcare sector, claiming it distributes about one-third of all pharmaceuticals used throughout North America. It reported $403.4 billion in revenue for the one-year period ending in March. 

The company’s size and critical role it serves also makes it a high-profile target for cybercriminals. McKesson did not identify the group behind the attack, but ShinyHunters, a cybercrime group known for targeting large organizations with extortion demands after stealing massive amounts of sensitive data, claimed responsibility.

The company declined to answer questions about ShinyHunter’s claims. Yet, on Friday, McKesson disclosed the attack in a regulatory filing while ShinyHunters added the company to its data-leak site. 

McKesson said it discovered the attack Aug. 25. A period of widespread data theft was over by then, following a four-day intrusion beginning Aug. 21, according to researchers.

“Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to support our response,” Fraga said in a statement. 

“We have reasonable assurance of no ongoing unauthorized activity in our systems. Customers can continue to connect to and use our systems and services as intended,” he added. 

While McKesson’s investigation continues, it faces a more urgent deadline of Sept. 1 from ShinyHunters, which is reportedly seeking a ransom demand in excess of $55 million. 

The company did not answer questions about any ransom demand or whether it responded to the alleged attackers. 

The circumstances of the attack against McKesson are similar to other recent victims of ShinyHunters. The threat group typically uses social engineering or abuses weaknesses in identity to gain access to cloud-hosted environments containing troves of sensitive or proprietary data, which it threatens to leak if the victim doesn’t pay a ransom. 

“Opportunistic data extortionists have been able to identify weaknesses within identity and access management, making these campaigns both cheap and scalable,” said Ian Gray, vice president of cyber threat intelligence at Flashpoint. 

“These attacks are particularly difficult to detect early because they often occur entirely within vendor-hosted environments using valid, socially-engineered credentials,” he added. “Since this activity mimics normal support or data-warehouse tasks, it typically doesn’t trip traditional malware alerts or show anomalies, meaning organizations often remain unaware of the breach until the extortionists make contact.”

Researchers have linked ShinyHunters to multiple attack sprees targeting major cloud platforms, including Oracle, Salesforce and Snowflake. The decentralized crew of cybercriminals was also linked to an expansive compromise last summer impacting hundreds of Salesloft Drift customers that put any platform integrated with the AI chat agent at risk as well. 

In April, ShinyHunters broke into the systems of Canvas — a central hub for K-12 and university coursework, exams, grades and communication — causing widespread outages and data theft. When an early deadline passed without payment, ShinyHunters escalated its pressure on Instructure, the company behind Canvas, by defacing the platform’s login pages with an extortion message that was visible to hundreds of schools.

Instructure ultimately relented and said it reached an agreement with the cybercriminals, insisting the stolen data was returned with assurances that other copies were destroyed.

The FBI issued a public service announcement about ShinyHunters days later, warning potential downstream victims of the threat group’s pressure tactics and claims.

In late July, less than a month before McKesson was hit, Health-ISAC warned organizations in the sector of an increase in successful attacks by ShinyHunters.

The post McKesson copes with fallout from data theft extortion attack appeared first on CyberScoop.

A cybercriminal exploited a critical defect Saturday in the payments processing feature of Oracle E-Business Suite that could mark the early stages of a potentially broader campaign, researchers said.

Defused, a threat intelligence firm, spotted six instances of exploitation during a two-hour window on its honeypots, or decoys designed to monitor malicious activity in non-production environments, Simo Kohonen, founder and CEO of the company, told CyberScoop.

Oracle disclosed and patched the vulnerability, which is tracked as CVE-2026-46817 with a 9.8 severity rating, in late May and warned that exploitation complexity is low.

Kohonen said the exploits were attributed to a single IP address and occurred before any proof-of-concepts were publicly available. 

“With only one IP and one day of data, it reads more like reconnaissance and weaponization testing than a targeted campaign against a specific victim,” he added.

The potential expansion of malicious activity on live networks could be significant. Shadowserver scans found about 950 potentially vulnerable instances of Oracle E-Business Suite on Wednesday, and more than half of those publicly exposed deployments are based in the United States. 

The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees. 

The notorious Clop ransomware group attempted to extort dozens of victims after it exploited a zero-day and other vulnerabilities in Oracle E-Business Suite last year. The aggressive extortion campaign got underway in October, roughly two months after Clop exploited the defect and stole data en masse.

Oracle customers were more recently impacted by an actively exploited zero-day vulnerability in PeopleSoft, which includes more than 40 tools for human resources and customer relationship management. 

ShinyHunters, the group behind that attack spree dating back to late May, potentially infiltrated the networks of more than 100 organizations mostly in higher education, according to Mandiant and Google Threat Intelligence Group.

The post Researchers spot exploitation of another critical Oracle defect appeared first on CyberScoop.