CoAceV (Malware): news timeline & CVEs

Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials

Chinese-language phishing kits used about 17,000 domains to steal credentials from Japanese bank and retail customers.

Proofpoint reports a Chinese-language phishing operation using about 17,000 domains and three related kits—CoGUI, CoAceV, and CoFish_Ws—to impersonate banks, payment services, and retailers, mainly in Japan. The kits sent emails about account updates, payments, and deliveries that led through CAPTCHA checks to fake login or payment pages collecting credentials and card data. Proofpoint counted 13,586 CoGUI domains, 2,812 CoAceV domains, and 191 CoFish_Ws domains, and observed 3,788 unique FQDNs between July 1 and September 17, 2026. Microsoft and Health-ISAC filed a civil lawsuit and, with partners including Proofpoint, Cloudflare, and Oracle, seized or redirected domains tied to YAM Store, CoGUI, and Iron Man.

Cyber Security NewsOct 16, 11:26 UTC · 17h agoPhishing & fraud in the wild 13 sources2· 1 read

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.

Microsoft, Health-ISAC, and partners disrupted the CoGUI phishing kit plus related YAM Store and Iron Man fraud infrastructure, seizing domains after a civil lawsuit in the Southern District of Florida. Proofpoint says CoGUI alone generated more than 100 million malicious emails a month, while Microsoft cited more than one billion messages targeting over 75,000 organizations since January 2026. Related kits CoAceV and CoFish_Ws share roots and mainly target Japan, impersonating brands such as Amazon, Apple, PayPay, and Rakuten to steal credentials and card data. Proofpoint recorded 1,081 CoGUI campaigns and about 17,000 unique domains across the three kits.

GBHackersupdated Oct 16, 11:26 UTC · 17h agofirst Oct 16, 08:54 UTC · 20h agoPhishing & fraud in the wild 13 sources2

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.

Microsoft, Health-ISAC, Japan’s JC3, and private partners announced a court-authorized disruption of phishing kits CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. Since January 2026, operators facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations in more than 150 countries, generating tens of millions of dollars. Microsoft tracks marketplace YAM Store as Storm-3119 and the kit developers as Storm-2990; the kits were sold for cryptocurrency and used compromised or fraudulent Microsoft and Google cloud tenants, including SharePoint and OneDrive hosting. About 17,000 domains and more than 2,300 brand-impersonation templates were involved, with real-world CoGUI use since at least October 2024.

The Hacker Newsupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 17:09 UTC · 2d agoPhishing & fraud in the wild 13 sources

CoAceV

Timeline3 articles

Appears with

Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages