FBI Seizes FishHub Phishing Kit and Microscan Scanner Used by Flax Typhoon

The Justice Department and FBI announced October 8, 2026 court-authorized seizures of seven domains used to run Microscan and FishHub — a vulnerability scanner and a spear-phishing kit that DOJ says China-based Integrity Technology Group operated for clients tied to the group the private sector calls Flax Typhoon. Papers were unsealed in the Western District of Pennsylvania. Houston desks picked it up the same day: Click2Houston and the Houston Chronicle.

This is a tooling disruption, not a named Texas-org breach. DOJ’s public victim list includes a South Carolina power company, a multinational NGO, airports in Japan and Poland, Taiwanese gas and power firms, and about 20 Taiwanese universities on the FishHub side. The Texas hook is the Houston reprint plus the same lookalike-mail problem every Texas inbox already has: names that almost look like Outlook, YouTube, or LinkedIn.

Companion advisory: CISA AA26-281A (FBI / CISA / NSA and partners). It tells defenders to require MFA, patch the listed CVEs, and treat unused remote-access ports as live risk. We are not reprinting indicators of compromise.

Official release: Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools

Snapshot

Magistrate papers on justice.gov list the same seven names and cite 18 U.S.C. 1030 and 371. CourtListener’s date_filed field is still empty on that row; the docket is indexed. The earlier QTFY / QScan / QTRouter seizure is a different PRC-tooling disruption.

What FishHub and Microscan did

DOJ says Integrity Tech ran a Mirai-variant IoT botnet that fed Microscan. Operators reached the scanner through c0cc.cc. Microscan hunted weaknesses its clients could later use. CISA describes it as a Python web app with more than 1,300 test scripts aimed at services such as WordPress, Jenkins, WebLogic, and Apache Struts.

FishHub is the email story. After an initial compromise, the kit pulled more malware that gave clients remote access or stole named files. FBI Special Agent Adam James wrote that the name fits because the tool facilitated phishing. Five seized names delivered that follow-on load: outlook3650.com, youtubecard.com, linkedinns.net, 98aicai.com, and 98aicode.com. A seventh, 98aiblog.com, hosted SoftEther persistence at two universities already scanned with Microscan.

Those lookalikes are now pointed at FBI seizure name servers (ns1.fbi.seized.gov / ns2.fbi.seized.gov) per the warrant. Type outlook.office.com, youtube.com, and linkedin.com. Do not open a leftover bookmark for the seized hosts.

This is DOJ’s second public Integrity Tech takedown. The first, in September 2024, hit a Mirai botnet of more than 200,000 consumer devices. FBI San Diego and Baltimore are investigating, with WD Pa. prosecutors.

What Texas orgs should do

1. Type cisa.gov for AA26-281A. Ignore “FBI seized your file / pay to unsink” mail that follows this headline.
2. Treat unexpected Outlook / YouTube / LinkedIn security mail as hostile until you typed the real host.
3. If you run WordPress, Jenkins, or Exchange, patch on the vendor’s calendar — CISA’s list is for defenders, not a homework assignment we will paste here.
4. Turn on phishing-resistant MFA for webmail and VPN. CISA names MFA in the key actions.
5. Forward suspect messages as attachments to phishing@txcc.texas.gov and report to ic3.gov.

MFA: YubiKey and Google Authenticator

A hardware key does not seize a botnet. It does cut a lot of the “Outlook 365 / LinkedIn security / FBI exhibit” phishing that follows a disruption headline. Grades match our MFA directory.

Login.gov documents a security key and apps including Google Authenticator. Microsoft documents FIDO2 keys and authenticator-app TOTP for work and consumer accounts. Phone OTP can still sit beside those paths — enroll a key. MFA would not have stopped a court-authorized domain seizure.

Directory: MFA support directory · Category → Email & Identity.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the DOJ, FBI, CISA, and Login.gov hosts on October 11, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not grade the seizure itself.

Audit links: fbi.gov · cisa.gov · justice.gov · login.gov

CISA Identity 90% is the bright spot. Transport 45% on three .gov hosts still means inbound “CISA AA26-281A / your IOC pack” mail can be downgraded without MTA-STS enforce. Login.gov Website 40% is the consumer-login host, not a finding on Integrity Tech.

Website stack note

Passive website-tech probes on October 11, 2026:

Point-in-time only. A homepage CMS version is not a forensic finding on Flax Typhoon.

Blacklist and lookalike domains

Email blacklist checks (public DoH, October 11, 2026): fbi.gov, cisa.gov, justice.gov, and login.gov were clear on mail/domain lists we can query.

DNS lookalike scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this case used them):

The warrant names — outlook3650.com, youtubecard.com, linkedinns.net — are a different class: they were seized, not merely registered lookalikes on our scan. Type fbi.gov, justice.gov, and cisa.gov. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• QTFY / QScan / QTRouter DOJ seizure
• FBI NCII lookalike support phishing
• FBI ransomware-negotiator arrest
• Texas Cyber Command / Cyber Ready
• MFA support directory

Run a free audit at audit.emailmenow.com or contact EmailMeNow for DMARC / MTA-STS and phishing response aimed at the 100% ideal.