Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.
Microsoft, Health-ISAC, and partners disrupted the CoGUI phishing kit plus related YAM Store and Iron Man fraud infrastructure, seizing domains after a civil lawsuit in the Southern District of Florida. Proofpoint says CoGUI alone generated more than 100 million malicious emails a month, while Microsoft cited more than one billion messages targeting over 75,000 organizations since January 2026. Related kits CoAceV and CoFish_Ws share roots and mainly target Japan, impersonating brands such as Amazon, Apple, PayPay, and Rakuten to steal credentials and card data. Proofpoint recorded 1,081 CoGUI campaigns and about 17,000 unique domains across the three kits.