A sprawling Chinese-language phishing operation used roughly 17,000 domains to impersonate banks, payment providers, retailers and delivery brands, with users in Japan bearing most of the activity. The infrastructure supported three related phishing kits—CoGUI, CoAceV and CoFish_Ws—that directed recipients from deceptive messages to convincing login or payment pages designed to capture credentials and financial information.

Proofpoint first identified CoGUI activity near the end of 2024 and subsequently connected it with the two other kits. Researchers assess with high confidence that the toolsets share common roots and are used by overlapping affiliates. Across the tracked campaigns, operators imitated 66 brands, most of them Japanese.

Domain rotation made the operation resilient

Proofpoint associated 13,586 unique domains with CoGUI, 2,812 with CoAceV and 191 with CoFish_Ws. Between July 1 and September 17, 2026 alone, researchers observed 3,788 unique fully qualified domain names. That pace illustrates why defenders cannot rely on a short, static list of blocked addresses.

The infrastructure was part of a much larger fraud economy. Microsoft data cited in the reporting linked YAM Store, CoGUI and Iron Man to more than one billion malicious messages aimed at over 75,000 organizations worldwide since January 2026. The numbers cover a wider ecosystem rather than only the Japanese campaigns, but they demonstrate the industrial scale available to affiliates.

Familiar messages led to cloned services

The lures used routine subjects such as bank-account updates, card verification, shopping orders, delivery notices and payment problems. A link could pass through filtering stages or a CAPTCHA before showing a page copied from a trusted service. That sequence makes the visit feel deliberate while helping operators distinguish likely victims from automated scanners.

Impersonated brands included PayPay, MyJCB, Rakuten, SMBC, Aeon Card, UC Card, Matsui Securities, Amazon, Apple, DHL and Yamato Transport. The fake pages requested login details, payment-card data or other account information. Most observed targeting occurred in Japan, although Proofpoint also saw campaigns affecting the United States, Australia and Italy. Financial services and healthcare were the most frequently affected sectors in its data, followed by government, education and manufacturing.

Filtering concealed phishing pages from analysts

CoGUI and CoAceV could redirect visitors to unrelated decoy pages when their browsing conditions did not fit an operator’s rules. Geography, device attributes, referral information or automated-analysis signals can all be used by phishing systems to decide what content to serve. The result is an uneven view: a victim may see a cloned bank portal while a security scanner receives a harmless website.

This selective delivery complicates takedowns and investigation. Rapid domain replacement also means that removing one set of hosts disrupts current campaigns without necessarily dismantling the people, kits and sales channels behind them.

Legal action disrupts part of the ecosystem

Microsoft and Health-ISAC filed a civil case against people linked to the operation and seized or redirected domains associated with YAM Store, CoGUI and Iron Man. Proofpoint, the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle and TRM Labs were among the public- and private-sector partners involved.

The action is expected to raise costs for operators and affiliates, but it does not prove that all related domains or campaigns have stopped. Phishing groups can rebuild infrastructure, modify kits or migrate to other providers, so organizations should regard disruption as an opportunity to strengthen defenses rather than a permanent resolution.

Reducing exposure to rotating phishing sites

• Encourage customers and employees to open a bank’s official app or type its known address instead of following message links.
• Use phishing-resistant multi-factor authentication wherever the service supports it.
• Monitor for unusual sign-ins, new devices, payment changes and account-recovery events.
• Analyze message content, sender behavior and destination patterns rather than depending only on domain reputation.
• Report confirmed phishing pages quickly and share indicators with relevant providers and industry partners.

For financial institutions, the central challenge is speed. A newly registered host may be used and discarded before conventional reputation systems catch up. Controls that bind authentication to the legitimate service, detect anomalous account behavior and give users a safe reporting channel remain valuable even as the visible domains continually change.