Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials
Chinese-language phishing kits used about 17,000 domains to steal credentials from Japanese bank and retail customers.
Proofpoint reports a Chinese-language phishing operation using about 17,000 domains and three related kits—CoGUI, CoAceV, and CoFish_Ws—to impersonate banks, payment services, and retailers, mainly in Japan. The kits sent emails about account updates, payments, and deliveries that led through CAPTCHA checks to fake login or payment pages collecting credentials and card data. Proofpoint counted 13,586 CoGUI domains, 2,812 CoAceV domains, and 191 CoFish_Ws domains, and observed 3,788 unique FQDNs between July 1 and September 17, 2026. Microsoft and Health-ISAC filed a civil lawsuit and, with partners including Proofpoint, Cloudflare, and Oracle, seized or redirected domains tied to YAM Store, CoGUI, and Iron Man.