CoGUI, CoAceV, and CoFish_Ws Kits Drive 17,000-Domain Phishing Campaign
A Chinese-language fraud network uses three related phishing kits and thousands of rotating domains to target Japanese banks and impersonate global brands.
Key points
- The operation utilizes CoGUI, CoAceV, and CoFish_Ws kits to distribute deceptive emails.
- Researchers tracked approximately 17,000 unique domains associated with these campaigns.
- Microsoft and partners seized domains linked to the wider fraud ecosystem.
A large-scale phishing operation targeting Japanese financial institutions and major retail brands has leveraged thousands of domains to distribute credential-stealing pages, according to Cyber Security News. The campaign relies on three interrelated software tools—CoGUI, CoAceV, and CoFish_Ws—to automate the creation and delivery of fraudulent login portals. This activity exposes organizations that fail to distinguish between legitimate brand communications and sophisticated impersonation attempts.
Root cause
The underlying issue is not a software vulnerability but the operational agility of the threat actors. Proofpoint researchers identified CoGUI activity late in 2024 and later connected it to CoAceV and CoFish_Ws. They assess with high confidence that overlapping affiliates operate all three kits. This shared infrastructure allows the group to scale rapidly while maintaining consistent branding across different phishing templates, complicating attribution and takedown efforts for defenders.
Attack path
Attackers send deceptive emails mimicking bank updates, payment confirmations, or delivery notices. Recipients clicking these links encounter CAPTCHA challenges before reaching fake portals that visually replicate trusted company interfaces. The pages prompt users to submit account credentials. Between July and September 2026, the group rotated through 3,788 unique fully qualified domain names. This rapid infrastructure churn ensures that even if some sites are blocked, others remain active.
Affected versions
The report does not identify specific software versions or products with vulnerabilities. Instead, it identifies the phishing toolkits involved:
- CoGUI
- CoAceV
- CoFish_Ws
Mitigation
No software patch exists because this is a social engineering campaign rather than a code defect. Defenders must rely on email filtering, user training, and strict domain monitoring. As BlueTeam Insider reported on 2026-10-15, similar kits like Iron Man have targeted global banks, highlighting the persistent nature of these threats. Organizations should verify the legitimacy of unexpected requests for personal data through out-of-band channels.
Detection notes
Security teams should monitor for spikes in failed login attempts from unfamiliar IP ranges or geographic locations inconsistent with user history. Look for outbound traffic to newly registered domains or sites with poor SSL certificate details. Investigate email headers for discrepancies in sender alignment and return paths. If suspicious activity is detected, isolate affected endpoints immediately to prevent lateral movement. Check proxy logs for requests to known phishing infrastructure and block associated domains at the DNS level.
Background: Phishing
Phishing tricks you into taking action by disguising malicious intent as legitimate communication. You stop it by verifying sources, using passkeys, and treating every unsolicited request as suspicious until proven otherwise. Technical controls like email authentication and network segmentation reduce risk but cannot eliminate human error.
Read the full guide: Phishing Defenses: Answers to 10 Critical Questions
What to do and how to stay safe: CoGUI
- Review email gateway logs for messages containing links to recently registered domains.
- Verify any request for credentials or payment details by contacting the purported sender through a known, trusted channel.
- Inspect browser history and proxy logs for visits to pages that mimic legitimate banking or retail portals.
- Ensure multi-factor authentication is enforced across all critical accounts to mitigate the impact of stolen passwords.
Step-by-step guide: Detect Phishing Infrastructure: Signals, Blind Spots and Tools
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific software products are vulnerable to this phishing campaign?
No software products are vulnerable; the threat involves phishing kits impersonating brands to steal credentials.
How many domains were used in this operation?
Researchers tracked approximately 17,000 unique domains across the three kits.
Did Microsoft participate in taking down this network?
Yes, Microsoft and partners seized domains linked to the operation, including those connected to CoGUI.
