The researchers discovered that the YAM Store evolved as different kits became available, and identified three popular PhaaS kits: Iron Man System, CoGUI, and Haozi.

The newer Iron Man system came to the fore in mid-2026. It provided pre-built lure pages capturing any victim-submitted data. The lure sites impersonated healthcare providers, police departments, government agencies, postal and courier services, toll and transportation authorities, tax agencies, banks, telecoms, and retailers. Through test purchases and intelligence work, investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.

Iron Man effectively expanded the PhaaS model by giving criminals access to thousands of ready-made templates tailored to specific industries, languages, and regions. Masada noted that many “used the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”