A vast phishing scheme originating from China has been discovered using approximately 17,000 domains to mimic banks, payment platforms, and major brands, with a particular focus on Japan. This operation employs three interconnected phishing kits, namely CoGUI, CoAceV, and CoFish_Ws, to lure unsuspecting users through deceptive emails.
International Efforts to Combat Phishing
In a coordinated effort, security firms and law enforcement agencies are taking steps to dismantle this fraudulent network. Notably, Microsoft and Health-ISAC have initiated legal action against individuals linked to the operation, seizing or redirecting domains associated with YAM Store, CoGUI, and Iron Man. This initiative includes contributions from entities such as Proofpoint, Japan Cybercrime Control Center, and Cloudflare.
Researchers from Proofpoint first detected CoGUI activities in late 2024, subsequently identifying the related kits CoAceV and CoFish_Ws. These kits have impersonated 66 brands, predominantly Japanese, posing significant risks to financial and personal data security.
Phishing Kits and Domain Usage
Proofpoint has identified 13,586 domains tied to CoGUI, 2,812 to CoAceV, and 191 to CoFish_Ws, totaling around 17,000 domains used during their investigation. The infrastructure supporting these campaigns is frequently rotated to avoid detection, as evidenced by the 3,788 unique fully qualified domain names observed between July and September 2026.
This adaptability enables the phishing campaigns to persist despite attempts to block known web addresses. According to Microsoft data, YAM Store, CoGUI, and Iron Man have facilitated over one billion malicious emails targeting more than 75,000 organizations worldwide since early 2026.
Impact and Security Measures
The phishing emails often mimic official communications about bank updates, payment details, or delivery notifications, redirecting users to counterfeit login pages. These pages are designed to capture sensitive information such as account credentials and payment details.
The operation primarily affects Japan but has also been detected in the United States, Australia, and Italy. The most impacted sectors include financial services, healthcare, and government.
To combat these threats, organizations are advised to scrutinize email links, implement multi-factor authentication, and promptly investigate unusual account activities. Individuals should avoid using links in unsolicited emails, opting instead to access services directly through official apps or websites.
Security teams should also remain vigilant, updating defenses against emerging threats and sharing threat intelligence with partners. As phishing methods evolve, maintaining robust cybersecurity measures is crucial to protect against such widespread attacks.
