Book a demo
Phishing

The Phishing Kits Built for Banks

Ready-made phishing kits let almost anyone run a convincing bank phishing campaign. Here’s what Microsoft’s October 2026 takedown reveals and what it means for financial institutions.

Ivor Jenik
November 5, 2026
5 min read
The Phishing Kits Built for Banks

For banks and financial institutions, a phishing page that copies your brand may not have been built by the person who sends it. Increasingly, it’s bought. Ready-made phishing kits, complete with cloned pages, message templates and the accounts needed to send them, are sold to anyone willing to pay, and the same kit can be used against many banks at once.

In October 2026, Microsoft announced it had disrupted three of these services. Its findings give a clear look at how the market behind bank phishing operates.

What Microsoft Took Down

Working with Health-ISAC, and following an alert from Japan’s National Police Agency, Microsoft obtained a US court order to seize the domains supporting three services: YAM Store, CoGUI and Iron Man.

Each covered a different part of a phishing campaign. YAM Store worked like an online shop, selling fraudulent Microsoft and Google accounts alongside ready-made scam tools. Its operators also took over expired domains, often from non-profit and education organizations, and rebuilt them to look active. CoGUI supplied ready-made websites and messages impersonating financial institutions, companies and government agencies, designed to capture passwords and payment details. Iron Man, which had largely replaced CoGUI by mid-2026, offered more than 2,300 templates for email, text messages and web pages, tailored by brand, industry, country and language.

Three services, one supply chain
The shopYAM StoreFraudulent Microsoft and Google accounts, ready-made scam tools and expired domains rebuilt to look active.20,000+accounts disabled by Microsoft
The pagesCoGUIReady-made websites and messages impersonating banks, companies and government agencies.Passwordsand payment details captured
The templatesIron ManEmail, text message and web page templates, tailored by brand, industry, country and language.2,300+templates on offer
Source: Microsoft, October 2026.

Banks were among the brands covered. One example in Microsoft’s findings was a fake rewards points redemption page for a bank, built to look like a routine customer offer rather than a security alert.

What a kit-built bank lure can look like
https://solsticepay-rewards.top/redeem
Solstice PayYour reward points are ready to redeemYou have 12,400 points expiring this month.Customer numberPasswordCard number, expiry and CVVRedeem my points
1
A lookalike domainThe brand name sits on a cheap domain the bank doesn't own.
2
A routine offerRewards and loyalty lures feel safe, so customers drop their guard.
3
Login and card detailsOne form collects everything needed to take over the account.
Illustration using a fictional brand, based on the bank rewards example in Microsoft’s findings.

How a Kit Reaches a Bank Customer

Buying a kit removes most of the work that used to sit behind a phishing campaign. Based on Microsoft’s findings, a campaign built from these services can follow five steps.

From kit to customer in five steps
01Buy the accounts
Ready-made email and cloud accounts give the campaign somewhere to send from and somewhere to host content.
02Choose a template
The buyer picks a bank, a country and a language from a catalog of pre-built pages and messages.
03Set up the domains
Lookalike domains, or expired domains rebuilt to look legitimate, host the cloned page.
04Send at volume
The same lure goes out by email and text message to large numbers of people at once.
05Collect the details
Logins, card details and personal information entered on the page are captured, then used or sold.

What the Numbers Show

Since January 2026, the three services were linked to more than 1 billion malicious messages, targeting more than 75,000 organizations across more than 150 countries, according to Microsoft. As part of the action, Microsoft disabled more than 20,000 accounts linked to YAM Store and blocked more than 100,000 impersonation and fraud domains. The operators are estimated to have earned tens of millions of dollars.

Linked to the three services since January 2026
1B+malicious messages
75K+organizations targeted
150+countries reached
20,000+accounts linked to YAM Store disabled
100,000+impersonation and fraud domains blocked
Source: Microsoft, October 2026.

The same pattern shows up in national figures. In Australia, phishing was the most reported scam type to Scamwatch in 2025, with 65,361 reports and $97.6 million in reported losses, according to the National Anti-Scam Centre. In the United States, phishing and spoofing was the most common complaint type in the FBI’s Internet Crime Report 2025, with 191,561 complaints, as reported by Biometric Update. In the UK, payment fraud losses reached £1.28 billion in 2025, and unauthorized fraud cases, where criminals use stolen card or account details, rose 11% to 3.81 million, according to UK Finance.

Phishing in 2025, by country
Australia65,361phishing reports to Scamwatch, the most reported scam type$97.6Min reported losses
United States191,561phishing and spoofing complaints, the most common type in the FBI’s Internet Crime Report
United Kingdom£1.28Blost to payment fraud3.81Munauthorized fraud cases, up 11%
Sources: National Anti-Scam Centre, Biometric Update and UK Finance.

What This Means for Financial Institutions

Phishing kits don’t create a new type of scam. What they change is who can run one, and how quickly it can be replaced once it’s found.

01
The barrier to entry is lowA convincing bank phishing campaign no longer needs technical skill, only the money to buy a kit. This can mean more separate operators targeting the same brand at the same time, each using the same templates.
02
The lure isn’t always a login pageThe bank example in Microsoft’s findings was a rewards redemption page. Teams that focus only on fake login pages may miss offers, loyalty programs and card-related pages built from the same kit.
03
Takedown has to be ongoingMicrosoft describes its action as disrupting these operations rather than ending them. When one domain is removed, the same template can be published on another, so a single takedown rarely closes a campaign.

Protecting Your Customers from Phishing Kits

Because kits are reused, the pages built from them often share the same structure, hosting or domain patterns. That gives banks something to look for beyond a single fake page.

  • Monitor beyond the login page. Watch for lookalike domains and cloned pages using your brand across rewards, card, loan and account-update journeys.
  • Connect related sites. Look for shared hosting, page code and domain patterns that link one fake page to others built from the same kit.
  • Act quickly, then keep watching. Request takedowns through registrars, hosts and platforms once a page is confirmed, and keep monitoring for the same template on new domains.
  • Remind customers how you contact them. Clear, consistent messaging about what the bank will and won’t ask for helps customers question an unexpected message.

Protect Your Brand with Unphish

Unphish is a threat detection and disruption platform built to identify and take down phishing, scams and brand impersonation across the web, social media and mobile apps.

For banks and financial institutions, Unphish monitors for lookalike domains, cloned sites, fake login pages and the phishing kits and infrastructure behind them. Each case is backed by captured evidence and analyst review, and related cases are linked by shared infrastructure, so you can see the wider campaign rather than a single page. With One-click Enforcement, takedown requests go to the right registrar, host or platform, and are tracked through to removal.

Learn more about protection for banking and financial services or book a personalized platform demonstration.