Description
Phishing campaigns targeting Japanese users have developed into a large-scale operation involving multiple related phishing kits and supporting services. These campaigns impersonate familiar brands and financial services to persuade victims to disclose usernames, passwords, payment credentials, and credit card information.
Proofpoint initially documented CoGUI activity targeting Japan in 2025. In October 2026, the company reported a broader disruption affecting CoGUI and related phishing infrastructure, including CoAceV, CoFish_Ws, YAM Store, and Iron Man. Proofpoint assesses with high confidence that CoGUI, CoAceV, and CoFish_Ws have common roots and are used by overlapping affiliates.
The disruption targeted infrastructure supporting a wider cybercrime ecosystem rather than a single phishing website. Microsoft and Health-ISAC filed a civil lawsuit against individuals linked to YAM Store, while domains enabling YAM Store, CoGUI, and Iron Man fraud were seized and redirected.
Technical Description
The phishing kits use brand impersonation, browser profiling, conditional content delivery, and frequently changing domains to make credential theft campaigns scalable and harder to detect.
CoGUI has used phishing pages impersonating companies and services such as Amazon, PayPay, Rakuten, Apple, and Japanese financial organizations. Other observed campaigns have impersonated payment-card providers, retailers, and transportation services.
Before displaying a phishing page, CoGUI can profile a visitor's browser and environment. Information used for this process includes geographical location, browser language, browser type and version, screen dimensions, operating-system platform, and whether the visitor is using a mobile device.
The kit can serve a phishing page only when the visitor satisfies its configured conditions. If the conditions are not met, it may redirect the browser to a legitimate website or a decoy destination. This selective behavior complicates automated analysis and can prevent security researchers from consistently observing the malicious page.
Attack Overview
The activity can be summarized as follows:
Brand impersonation: Attackers prepare email lures that appear to originate from familiar companies, banks, payment services, or retailers.
Delivery: Recipients receive messages containing URLs that direct them toward phishing infrastructure.
Victim profiling: The phishing kit checks browser and environmental characteristics, potentially including location, language, and device type.
Conditional presentation: Visitors who satisfy the configured conditions are shown a counterfeit login or payment page. Other visitors may be redirected to legitimate or decoy websites.
Credential and payment-data collection: Victims are prompted to enter account credentials and, in some campaigns, payment-card details.
Fraud and account compromise: Stolen information can enable account takeover, unauthorized transactions, and further financial or reputational harm.
Technical Analysis
1. CoGUI Phishing Kit
Proofpoint identified CoGUI as a highly evasive phishing framework that primarily targets Japanese users and organizations. Its campaigns have impersonated popular consumer and financial brands and have used high-volume email distribution.
In its May 2025 report, Proofpoint noted that CoGUI campaign volumes had peaked at more than 172 million messages during January 2025. The kit uses browser profiling, geofencing, and other filtering mechanisms to reduce exposure to automated analysis.
The observed phishing flow has included counterfeit authentication pages followed by requests for payment information. Proofpoint noted that the campaigns it observed at the time did not demonstrate collection of multifactor authentication credentials, although it could not rule out unobserved variants with that capability.
2. Related Kits: CoAceV and CoFish_Ws
Proofpoint subsequently identified two related kits, CoAceV and CoFish_Ws. The company assessed with high confidence that all three kits share common roots and are operated by overlapping affiliates.
Campaigns associated with these kits have used similar targeting patterns, decoy techniques, and URL structures. These overlaps indicate relationships within the phishing ecosystem, although shared characteristics do not necessarily mean that every campaign is operated by the same individual or group.
Between July 1 and September 17, 2026, Proofpoint observed 3,788 unique fully qualified domain names used by the three kits. The frequent rotation of domains indicates an operation capable of maintaining and replacing phishing infrastructure at scale.
3. Evasion and Decoy Techniques
CoGUI and related kits use conditional redirection to limit what automated analysis systems see. In February 2026, Proofpoint observed CoGUI redirecting visitors to destinations such as www.a.com, www.b.com, or www.c.com when browsing conditions were not met.
Proofpoint later observed CoAceV using the same decoy method. The researchers also documented overlaps in URL paths and patterns across CoGUI, CoAceV, and CoFish_Ws.
These techniques can make detection more difficult because the same phishing URL may behave differently depending on the visitor's environment and the conditions evaluated by the kit.
4. Brand Impersonation and Targeting
The phishing ecosystem has impersonated dozens of brands. Reported examples include Amazon, PayPay, MyJCB, Apple, Orico, Rakuten, SMBC, Saison Card, Aeon Card, UC Card, Matsui Securities, DHL, and Yamato Transport.
Messages may use themes involving account verification, payment requests, expiring reward points, banking information, or shipping notifications. These themes encourage recipients to act quickly and enter sensitive information on fraudulent websites.
Although Japan is the principal target, Proofpoint has also observed campaigns affecting users in the United States, Australia, and Italy.
5. Disruption of the Wider Ecosystem
The October 2026 disruption targeted infrastructure and services that supported a broader phishing and fraud ecosystem. Proofpoint supported Microsoft and other public and private partners by providing threat data related to CoGUI, CoAceV, and CoFish_Ws campaigns.
Microsoft and Health-ISAC filed a civil lawsuit, and domains enabling YAM Store, CoGUI, and Iron Man fraud were seized and redirected. Proofpoint assessed that the action could create significant operational friction for the operators and affect the effectiveness of their phishing campaigns.
However, infrastructure disruption does not necessarily eliminate the people, techniques, or capabilities behind an operation. Continued monitoring remains important because operators may attempt to rebuild infrastructure or move to alternative services.
IOC
The source reports examples of phishing URLs and shared URL patterns associated with CoGUI and related kits. The following indicators are reproduced in defanged form for safer handling.
CoGUI examples
hxxps://zjkso[.]cn/QJSmxXOQ/— SBI-branded phishing landing pagehxxps://uhlkg[.]cn/HJmOkggh— Rakuten-branded phishing landing pagehxxps://kzongfd[.]bo5wfb0f9[.]top/Kfade— Amazon-branded phishing landing pagehxxps://evrryday[.]com/paypay-login-ne-jp— PayPay-branded phishing landing page
Related-kit URL patterns
CoGUI:
hxxps://kenandy[.]shop/paidy/ubmisionsjp/CoAceV:
hxxps://paidy[.]farradae[.]com/paidy/ubmissionsjpCoGUI:
hxxps://lygyaou[.]com/9AioLNhtdi[.]kumamoto-city[.]jpCoAceV:
hxxps://ylhgkj[.]com/BCuXkTPfKZ[.]kumamoto-city[.]jpCoFish_Ws:
hxxps://new-app-haixing[.]com/1DWSd1DeDf[.]kumamoto-city[.]jp
These are examples reported by Proofpoint, not a complete list of infrastructure. Domains may be inactive or may have changed ownership or behavior since publication. Verify indicators against current threat-intelligence sources before blocking or using them in detection rules.
Potential Impact
The phishing ecosystem presents risks to individuals and organizations, particularly those operating in financial services, healthcare, government, education, manufacturing, retail, and transportation.
Potential consequences include:
Theft of usernames and passwords
Exposure of payment-card information
Unauthorized access to financial and consumer accounts
Financial fraud and unauthorized transactions
Account takeover and misuse of legitimate identities
Reputational damage and incident-response costs
Increased phishing exposure for organizations whose brands are impersonated
The scale of the operation is significant. According to Microsoft's data cited by Proofpoint, YAM Store, CoGUI, and Iron Man had enabled more than one billion malicious messages targeting over 75,000 organizations worldwide since January 2026.
Recommendations
Immediate Actions
Block confirmed malicious URLs: Review the reported indicators against current threat intelligence and block confirmed malicious destinations through email gateways, DNS filtering, secure web gateways, and endpoint controls.
Search for phishing messages: Examine email telemetry for brand-impersonation lures, suspicious redirects, and messages referencing account verification, payment issues, or expiring rewards.
Protect affected accounts: If credentials may have been exposed, reset passwords, revoke active sessions, and review authentication logs for suspicious access.
Review financial activity: Investigate unusual transactions or changes to payment details following suspected account compromise.
Improve reporting: Provide a clear process for users to report suspicious emails and URLs to the security team.
Monitor brand impersonation: Track fraudulent websites and messages impersonating organizational brands or services.
Preventive Actions
Strengthen authentication: Enable multifactor authentication across applications and services. Where possible, prefer phishing-resistant authentication such as FIDO2 security keys or passkeys.
Deploy email security controls: Use URL analysis, attachment scanning, sender-authentication checks, and anti-phishing detections.
Train users: Educate staff about brand impersonation, urgent payment requests, fake account-verification notices, and suspicious links.
Use layered web protection: Combine DNS filtering, web filtering, endpoint detection, and network monitoring to identify access to phishing infrastructure.
Monitor account activity: Alert on unusual login locations, anomalous authentication patterns, and suspicious changes to account recovery or payment settings.
Maintain threat intelligence: Update detection rules and blocklists using verified indicators from trusted sources, while reviewing possible false positives before broad blocking.
Prepare for infrastructure changes: Expect phishing operators to rotate domains or rebuild services after disruption. Monitor for new infrastructure and related URL patterns.
Conclusion
The disruption targeting CoGUI and its related phishing ecosystem represents an important action against high-volume credential theft and financial fraud operations. The combined reporting from Proofpoint shows how phishing kits can use brand impersonation, browser profiling, decoy redirection, and rapidly changing domains to reach victims at scale.
The operation also demonstrates the value of collaboration between cybersecurity researchers, technology companies, and public-sector partners. While the seizure and redirection of supporting infrastructure can disrupt criminal activity, organizations should continue to protect accounts, monitor suspicious email and web activity, and respond quickly to possible credential exposure.