Key findings
- A disruption action targeting prominent players across the Chinese-speaking phishing and fraud ecosystem struck a blow to the most high-volume threats in Proofpoint data.
- Proofpoint supported Microsoft and other private and public partners in the civil lawsuit and takedown action.
- The highest-volume direct email threats in Proofpoint campaign data come from three phishing kits our researchers named CoGUI, CoAceV, and CoFish_Ws, which all actively target Japanese organizations. These are part of the targeted actions.
- Campaigns linked to these phishing kits impersonate well-known companies, mainly consumer and finance brands, and distribute hundreds of millions of messages.
- Proofpoint assesses with high confidence that all these phishing kits have common roots and are used by overlapping affiliates.
- The disruption that includes broader ecosystem enablers YAM Store and Iron Man is likely to impact the efficacy and success of these phishing kits, potentially causing operational, reputational, and financial damage to the threat actors.
Overview
A recent disruption targeted a group of Chinese-speaking cybercrime threat actors and the infrastructure supporting their credential phishing activities.
CoGUI and related infrastructure was disrupted in collaboration with private and public partners including Proofpoint, Microsoft, Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, and TRM Labs. Microsoft and co-plaintiff Health-ISAC also filed a lawsuit against the YAM Store threat actors and individuals linked to the phishing operations. Microsoft and Health-ISAC seized and redirected domains enabling YAM Store, CoGUI and Iron Man fraud.
The disruption and associated civil filing in the U.S. District Court for the Southern District of Florida is likely to have a significant impact on CoGUI operations and overall threat activity.
Proofpoint supported Microsoft's action with threat data from our visibility, including malicious domains and information related to CoGUI, CoAceV and CoFish_ws campaigns, and provided a declaration for the suit.
In addition to the disruption, the following splash page was displayed on the seized domains:
Figure 1: Splash page shown to visitors of malicious sites.
The takedown targeting threat actors responsible for hundreds of millions of malicious messages attempting financial fraud will likely have a measurable impact on the Chinese phishing ecosystem and cause significant operational friction among multiple threat groups.
Background
Towards the end of 2024, Proofpoint researchers identified an emerging cluster of phishing activity consistently targeting Japan with very high volumes of email campaigns. We then released public details on a phishing kit that Proofpoint researchers referred to as “CoGUI”, highlighting how the phishing kit impersonated well-known Japanese or international companies in order to steal usernames, passwords, and payment data such as credit card information.
In the days following our publication, the phishing kit developer introduced what appeared to be a joke in the kit as a response to our report, as we saw a new pattern “coguicogui” appear in the network communications.
Since then, this highly evasive kit has made Japan one of the most targeted countries in Proofpoint data based on campaign volumes. We detect and block over 100 million email messages per month targeting organizations using the CoGUI phishing kit to steal usernames, passwords, and payment data.
More than one year later, the CoGUI phishing kit is still regularly used by cybercriminals, according to Proofpoint data. Yet two other phishing kits have also appeared, closely related to CoGUI, expanding the ecosystem of Chinese-language phishing kits. We named those kits CoAceV and CoFish_Ws and assess with high confidence these three kits are all related.
They are part of the broader ecosystem. According to Microsoft’s data, YAM Store, CoGUI and Iron Man have enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, since January 2026.
Campaign Details
In total, Proofpoint has observed 66 different brands being impersonated by those phishing kits, most of these brands being Japanese. Examples of impersonated brands include Amazon, PayPay, MyJCB, Apple, Orico, Rakuten, SMBC, Saison Card, Aeon Card, UC Card, Matsui Securities, DHL, Yamato Transport.
|
Phishing kit Name |
Number of campaigns |
Number of unique domains used |
|
CoGUI |
1081 |
13586 |
|
CoAceV |
242 |
2812 |
|
CoFish_Ws |
19 |
191 |
Table 1: Phishing kits statistics
Overall, we have observed around 17,000 unique domains used by these three phishing kits since we began tracking their use. The groups create and rotate domains frequently; between 01 July and 17 September 2026, for example, we observed 3,788 unique fully qualified domain names (FQDNs) being used by the three phishing kits. This indicates a dynamic operation that has the capabilities and resources to purchase and manage phishing infrastructure at scale.
Email lures vary and can relate to financial and banking information, credit card or payment account details, consumer retail information, or shipping and transportation, among other themes. Messages contain URLs that lead, after a variety of filtering including CAPTCHA, to landing pages that masquerade as login or payment portals for the impersonated companies.
Figure 2: Anonymized CoFish_ws e-mail impersonating JACCS.
Figure 3: CAPTCHA used in a CoFish_ws campaign.
Figure 4: CoFish_ws phishing page impersonating JACCS and requesting credentials.
Figure 5: CoFish_ws phishing page impersonating JACCS and requesting credit card information.
Phishing kit overlaps
Over time we have found overlaps between the different phishing kits, including characteristics of targeting, decoy landing pages, URL structure, and more.
For example, in February 2026, we saw a new decoy method on the CoGUI phishing kit. When browsing conditions were not met, the phishing kit would decoy the browser to www.a.com, or www.b.com, or www.c.com. (A decoy is used by the threat actor to direct traffic to a different website than the phishing kit to avoid detection by automated sandboxing.) A few days after CoGUI began using this method, we observed the CoAceV phishing kit employ the exact same decoy method in campaigns.
As an example, two Apple phishing campaigns, one using CoGUI, one using CoAceV, appeared during the same period of time from 13 to 17 April 2026 using the same decoy page.
Additionally, we have also observed overlap in URL patterns and paths. In these cases, the unique domains are operated by one phishing kit, but both share the same or similar URL paths.
CoGUI: hxxps://kenandy[.]shop/paidy/ubmisionsjp/
CoAceV: hxxps://paidy[.]farradae.com/paidy/ubmissionsjp
CoGUI: /MoldWnfEpQOjMnhOpLnumth/help
CoAceV: /SmbdWnfEp7OjMnhEVdyubtCl/help
One URL pattern has been used by the three kits:
CoGUI: hxxps://lygyaou[.]com/9AioLNhtdi.kumamoto-city[.]jp
CoAceV: hxxps://ylhgkj[.]com/BCuXkTPfKZ.kumamoto-city[.]jp
CoFish_ws: hxxps://new-app-haixing[.]com/1DWSd1DeDf.kumamoto-city[.]jp
Impact
The vast majority of tracked CoGUI/CoAceV/CoFish_Ws campaigns impact Japan, with a few impacting the United States of America, Australia, and Italy. According to our email threat data, the most frequently impacted business sectors are Financial Services and Healthcare, with Government, Education, and Manufacturing rounding out the top five impacted sectors.
The threat actors seem particularly interested in gaining access to financial services. In 2025, Japanese authorities published details about an increase in phishing activity targeting financial organizations. The goal of the threat actors was reportedly to gain access to victims' accounts for financial gain, and in most cases, using illicit gains to buy Chinese stocks. Based on the observed activity and third-party reporting, it is possible this activity was linked to CoGUI credential phishing threat actors. This aligns with the group’s financial theft objective and fraud campaigns.
Disruption
Successful account takeovers can cause significant harm to compromised organizations including financial and reputational damage. CoGUI and related kits are high volume, and consistently some of the most active threats in Proofpoint data. With this disruption that targeted the broader ecosystem including YAM Store and Iron Man, we hope this changes.
Proofpoint’s mission is to provide the best human-centric protection for our customers against advanced threats. Whenever it is possible and appropriate to do so, and as is the case with the CoGUI disruption, Proofpoint uses its team’s knowledge and skills to help protect a wider audience against widespread malware and phishing threats. Proofpoint was proud to assist in the investigations into CoGUI, CoAceV, and CoFish_ws activity.
Through its unique vantage point, Proofpoint is able to identify the largest and most consequential email threat distribution campaigns, providing the authorities with much-needed insight into the biggest threats to society, affecting the greatest number of people around the world.