Key points
- The campaign utilizes approximately 17,000 unique domains across three related phishing kits.
- Proofpoint researchers identified CoGUI, CoAceV, and CoFish_Ws as the primary tools used.
- Microsoft and partners seized domains linked to the network in a coordinated legal action.
A large-scale Chinese-language phishing operation has targeted Japanese banks, payment services, and retailers using roughly 17,000 internet domains, according to Cyber Security News. The campaign relies on three related kits—CoGUI, CoAceV, and CoFish_Ws—to send deceptive emails that direct victims to fake login or payment pages. This activity places financial accounts and personal data at significant risk for organizations operating in or serving the Japanese market.
By the numbers
- 17,000 unique domains used collectively by the three phishing kits during the tracking period.
- 13,586 domains specifically associated with the CoGUI kit, the largest of the three.
- 3,788 unique fully qualified domain names observed between July 1 and September 17, 2026.
What the figures mean
Proofpoint researchers identified CoGUI activity toward the end of 2024 and later tracked the related CoAceV and CoFish_Ws kits. The firm assesses with high confidence that these tools share roots and are used by overlapping affiliates. The operation impersonated 66 brands, most of them Japanese, sending messages about bank account updates, credit cards, shopping orders, and delivery notices. Links in these emails often pass through filtering steps, including CAPTCHA checks, before revealing pages that copy trusted company portals to steal credentials.
What should you do?
Managed service providers should immediately review email filtering logs for traffic originating from domains linked to CoGUI, CoAceV, or CoFish_Ws. Security teams must verify that their threat intelligence feeds include indicators of compromise related to this specific Japanese-targeted campaign. Organizations should also audit their web proxy logs for connections to recently registered domains that mimic legitimate banking or retail infrastructure.
Operational impact
When a campaign of this scale emerges, operational leaders must assess how quickly their detection systems can adapt to rapid infrastructure changes. Teams usually need to confirm whether their current blocking lists are updated in real time or rely on static signatures that may miss rotated domains.
Internal communications should inform customer-facing staff about the specific lures used, such as fake delivery notices or bank alerts, so they can recognize suspicious requests. Suppliers providing email security or web filtering services should be queried about their visibility into these specific kits. Incident response plans must account for the possibility that some malicious domains may slip through initial filters due to CAPTCHA-based evasion techniques.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe: CoGUI
- Monitor email gateways for messages containing links to newly registered domains that mimic legitimate Japanese financial or retail brands.
- Verify that web proxies are configured to block known malicious fully qualified domain names associated with CoGUI, CoAceV, and CoFish_Ws.
- Train end users to recognize phishing attempts that use CAPTCHA checks as a preliminary step before presenting fake login pages.
- Coordinate with security vendors to ensure threat intelligence feeds are updated with the latest indicators from this campaign.
Step-by-step guide: Security Awareness Training: What It Is and How It Works
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which phishing kits are involved in this campaign?
The operation uses three related kits: CoGUI, CoAceV, and CoFish_Ws.
How many domains were used in total?
Researchers tracked approximately 17,000 unique domains across the three kits.
Did any action result from this discovery?
Microsoft and Health-ISAC filed a civil lawsuit and seized or redirected domains connected to the operation.
