Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem

Resecurity profiled and mapped the infrastructure for a commercial phishing-kit-as-a-service called "Iron Man System": a self-hosted, subscription-licensed PhaaS with a Go backend, a public build registry (911 published builds), and an S3-compatible storage backend holding captured data. The kit ships 2,360 phishing templates across 130 target areas (17.4 GB of captured telemetry for 1,566 templates), is actively updated, and is linked to a cluster of domains used for licensing, telemetry, storage and distribution; the report includes defanged IOCs and recommends coordinated disruption of the authorization and storage hosts to mitigate widespread buyer deployments.