CoGUI (Malware): news timeline & CVEs

Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials

Chinese-language phishing kits used about 17,000 domains to steal credentials from Japanese bank and retail customers.

Proofpoint reports a Chinese-language phishing operation using about 17,000 domains and three related kits—CoGUI, CoAceV, and CoFish_Ws—to impersonate banks, payment services, and retailers, mainly in Japan. The kits sent emails about account updates, payments, and deliveries that led through CAPTCHA checks to fake login or payment pages collecting credentials and card data. Proofpoint counted 13,586 CoGUI domains, 2,812 CoAceV domains, and 191 CoFish_Ws domains, and observed 3,788 unique FQDNs between July 1 and September 17, 2026. Microsoft and Health-ISAC filed a civil lawsuit and, with partners including Proofpoint, Cloudflare, and Oracle, seized or redirected domains tied to YAM Store, CoGUI, and Iron Man.

Cyber Security NewsOct 16, 11:26 UTC · 16h agoPhishing & fraud in the wild 13 sources2· 1 read

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.

Microsoft, Health-ISAC, and partners disrupted the CoGUI phishing kit plus related YAM Store and Iron Man fraud infrastructure, seizing domains after a civil lawsuit in the Southern District of Florida. Proofpoint says CoGUI alone generated more than 100 million malicious emails a month, while Microsoft cited more than one billion messages targeting over 75,000 organizations since January 2026. Related kits CoAceV and CoFish_Ws share roots and mainly target Japan, impersonating brands such as Amazon, Apple, PayPay, and Rakuten to steal credentials and card data. Proofpoint recorded 1,081 CoGUI campaigns and about 17,000 unique domains across the three kits.

GBHackersupdated Oct 16, 11:26 UTC · 16h agofirst Oct 16, 08:54 UTC · 19h agoPhishing & fraud in the wild 13 sources2

Iron Man Phishing-as-a-Service Kit Impersonates Banks, Couriers and Government Agencies Worldwide

Iron Man phishing-as-a-service impersonates banks and agencies; Microsoft tracks its developers as Storm-2990.

Resecurity and Microsoft describe Iron Man System, a commercial phishing-as-a-service kit that supplies self-hosted sites impersonating banks, couriers, tax agencies, and other organizations. A lab deployment of version 6.3.1 used a Go backend, and Resecurity counted 2,360 templates across 130 countries, with licensing tied to api2.peaceman.cc. Operators collect credentials, payment data, and verification codes over WebSockets and can steer sessions interactively, with Telegram notifications, geofencing, fake CAPTCHA gates, and IP filtering. Microsoft tracks the developers of Iron Man, CoGUI, and Haozi as Storm-2990 and links the wider YAM Store ecosystem, tracked as Storm-3119, to more than one billion malicious messages since January 2026, a figure not exclusive to Iron Man. Microsoft and Health-ISAC obtained a Florida federal order to seize supporting domains.

GBHackersupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 10:32 UTC · 1d agoPhishing & fraud in the wild 13 sources

Microsoft disrupts phishing network behind more than a billion scam messages

Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.

Microsoft and Resecurity identified YAM Store, tracked as Storm-3119, which sold the CoGUI, Haozi, and Iron Man System phishing kits attributed collectively to Storm-2990. Since January 2026 those kits helped send more than one billion phishing emails and SMS messages targeting over 75,000 organizations in healthcare, financial services, wholesale, and IT across Japan, the United States, Australia, and India. The market also sold compromised or fraudulently obtained Microsoft and Google cloud accounts, reset passwords, assigned licenses, and turned SharePoint and OneDrive into buyer hosting; Iron Man System contained more than 2,335 templates for over 139 countries and alerted operators on Telegram. With Health-ISAC and an order from the US District Court for the Southern District of Florida, Microsoft seized supporting domains, disabled more than 20,000 accounts, and blocked more than 100,000 impersonation domains after a late-2025 referral from Japan's National Police Agency.

Help Net Securityupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 10:10 UTC · 1d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

Microsoft and partners disrupted Yam Store, a phishing service behind over one billion messages since January 2026.

Microsoft and partners, including Japanese police, disrupted Yam Store (Storm-3119), a Chinese-language phishing-as-a-service marketplace. Its CoGUI, Haozi, and Iron Man System kits, tracked as Storm-2990, sent more than one billion phishing emails and texts to over 75,000 organizations since January 2026, hitting healthcare, finance, wholesale, and IT in Japan, the US, Australia, and India. Operators reused expired domains and fake tenants to obtain Microsoft 365 and Google accounts for resale, using fake login pages, device-code phishing, and payment theft. Microsoft disabled more than 20,000 accounts and blocked over 100,000 domains.

Infosecurity Magazineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 10:00 UTC · 1d agoPhishing & fraud in the wild 13 sources2

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.

Microsoft's Digital Crimes Unit says it dismantled YAM Store, a Chinese-language phishing-as-a-service marketplace, after a nearly year-long investigation that began with a late-2025 tip from Japan's National Police Agency. The marketplace and kits including Iron Man System, CoGUI, and Haozi enabled more than 1 billion malicious messages to over 75,000 organizations, including more than 750 million sent to Microsoft customers, and generated tens of millions of dollars. Customers bought fraudulent Microsoft and Google accounts, expired-domain infrastructure, and more than 2,300 lure templates impersonating organizations in over 150 countries. Partners included Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

CSO Onlineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 01:20 UTC · 2d agoPhishing & fraud in the wild 13 sources

Yam Store: The Phishing Network Behind a Billion Messages

Microsoft says Yam Store, tracked as Storm-3119, fueled over one billion phishing emails and texts.

Microsoft Threat Intelligence and the Microsoft Digital Crimes Unit described a Chinese-language phishing ecosystem centered on Yam Store, which Microsoft tracks as Storm-3119. The marketplace supplied phishing kits and cloud infrastructure used to send more than one billion emails and SMS messages to tens of thousands of organizations in nine months. Kits identified with Resecurity include CoGUI and Haozi, also called Phoenix. Yam Store also sold Microsoft and Google domains associated with legitimate, expired, or previously used organizations so campaigns looked more trustworthy.

Dark Readingupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 20:57 UTC · 2d agoPhishing & fraud in the wild 13 sources2· 1 read

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.

Microsoft, Health-ISAC, Japan’s JC3, and private partners announced a court-authorized disruption of phishing kits CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. Since January 2026, operators facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations in more than 150 countries, generating tens of millions of dollars. Microsoft tracks marketplace YAM Store as Storm-3119 and the kit developers as Storm-2990; the kits were sold for cryptocurrency and used compromised or fraudulent Microsoft and Google cloud tenants, including SharePoint and OneDrive hosting. About 17,000 domains and more than 2,300 brand-impersonation templates were involved, with real-world CoGUI use since at least October 2024.

The Hacker Newsupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 17:09 UTC · 2d agoPhishing & fraud in the wild 13 sources

Global takedown hits network behind 1 billion phishing messages

Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.

Microsoft, Japan’s National Police Agency, and partners disrupted YAM Store (Storm-3119) and phishing kits CoGUI, Haozi, and Iron Man, tracked as Storm-2990. The ecosystem is linked to more than a billion malicious email and SMS messages aimed at over 75,000 organizations in 150 countries, including over 750 million messages to Microsoft customers, many using device-code phishing. Operators bought expired domains, built fake organizations with AI, and abused SharePoint and OneDrive. Under a Southern District of Florida order, Microsoft seized related domains, deactivated over 20,000 accounts, and blocked 100,000 impersonation domains.

BleepingComputerupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 13:12 UTC · 2d agoPhishing & fraud in the wild 13 sources

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft details a Chinese-language phishing-kit market that enabled over one billion messages to 75,000 organizations.

Microsoft’s Digital Crimes Unit described a Chinese-language phishing ecosystem centered on YAM Store, tracked as Storm-3119, which brokers compromised or fraudulently obtained Microsoft and Google cloud environments. Kits sold there—CoGUI, Haozi, and Iron Man, tracked collectively as Storm-2990—facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations since January 2026. Targets included healthcare, financial services, wholesale distribution, and IT organizations in Japan, the United States, Australia, and India. Storm-3119 used Tor-anonymized reconnaissance to profile Microsoft 365 tenants, then hijacked education tenants and resold accounts, licenses, and storage; Microsoft and partners disrupted the primary infrastructure.

Microsoft Security Blogupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 13:00 UTC · 2d agoThreat actor in the wild 13 sources

Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem

Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.

Microsoft, Japanese authorities, Health-ISAC, and several security companies disrupted Chinese-language phishing kits tracked as Storm-2990. Since the start of 2026, the kits sent more than one billion phishing emails and SMS messages to more than 75,000 organizations, with more than three-quarters aimed at Microsoft customers. Under a federal court order, Microsoft and Health-ISAC seized and redirected domains powering YAM Store, CoGUI, and Iron Man; Microsoft also disabled more than 20,000 accounts and is blocking more than 100,000 impersonation domains. Criminals used the kits to steal credentials and financial data and abused device-code authentication to obtain tokens, mainly for payment fraud against healthcare, finance, logistics, and IT targets in the United States and Japan.

CyberScoopupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 13:00 UTC · 2d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.

Microsoft and Health-ISAC, under an order from the US District Court for the Southern District of Florida, seized and redirected domains used by YAM Store, CoGUI, and Iron Man. Microsoft says those services sent more than one billion malicious messages since January 2026 to consumers and over 75,000 organizations in more than 150 countries, including over 750 million aimed at Microsoft customers. YAM Store, tracked as Storm-3119, resold compromised Microsoft 365 and Azure for Education tenants, while CoGUI, Haozi, and Iron Man are Storm-2990 phishing kits that harvest credentials and one-time codes. Microsoft disabled over 20,000 related accounts and is blocking more than 100,000 impersonation domains.

SecurityWeekupdated Oct 16, 11:26 UTC · 16h agofirst Oct 14, 13:00 UTC · 2d agoPhishing & fraud in the wild 13 sources

CoGUI

Timeline12 articles

Appears with