Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials

A large Chinese-language phishing operation has used around 17,000 internet domains to impersonate banks, payment services, retailers and other well-known brands, with Japan as its main target.

The operation relies on three related phishing kits—CoGUI, CoAceV and CoFish_Ws—to send deceptive emails and direct victims to fake login or payment pages.

The findings come as security companies and law-enforcement partners disrupt parts of the wider fraud network. Microsoft and Health-ISAC filed a civil lawsuit against people linked to the operation and seized or redirected domains connected to YAM Store, CoGUI and Iron Man.

The action involved public- and private-sector partners, including Proofpoint, Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle and TRM Labs.

Researchers from Proofpoint identified the CoGUI activity toward the end of 2024 and later tracked two related kits, CoAceV and CoFish_Ws. Proofpoint assesses with high confidence that the three kits share roots and are used by overlapping affiliates.

The researchers say their campaigns have impersonated 66 brands, most of them Japanese, and have sent messages at a scale that puts financial accounts and personal data at risk.

Chinese Phishing Network Uses 17,000 Domains

Proofpoint counted 13,586 domains associated with CoGUI, 2,812 with CoAceV and 191 with CoFish_Ws. Together, the kits used around 17,000 unique domains over the period the researchers tracked them.

The groups also rotate infrastructure: between July 1 and September 17, 2026, Proofpoint observed 3,788 unique fully qualified domain names, or FQDNs. An FQDN is the complete domain name used to reach a specific host on the internet.

Phishing kit	Campaigns observed	Unique domains observed
CoGUI	1,081	13,586
CoAceV	242	2,812
CoFish_Ws	19	191

The totals show why defenders cannot rely on blocking a short list of fixed web addresses. Frequent domain changes give campaigns room to keep running after some sites are identified or removed.

The operation’s scale also connects to a wider ecosystem: Microsoft data cited by Proofpoint says YAM Store, CoGUI and Iron Man enabled more than one billion malicious messages targeting over 75,000 organizations worldwide since January 2026.

The emails use themes such as bank account updates, payment details, credit cards, shopping orders and delivery notices. Their links can lead through filtering steps, including CAPTCHA checks, before opening a page that copies a trusted company’s login or payment portal.

The fake pages then ask users to enter account details. This resembles tactics described in Cyber Security News’ earlier report on the CoGUI phishing kit and brand impersonation, which also documented attempts to collect credentials and payment-card data.

The brands named by Proofpoint include PayPay, MyJCB, Rakuten, SMBC, Aeon Card, UC Card, Matsui Securities, Amazon, Apple, DHL and Yamato Transport.

How the phishing pages steal information

Most observed activity affected Japan, though Proofpoint also reported campaigns touching the United States, Australia and Italy. Financial services and healthcare were the most frequently affected sectors in its data, followed by government, education and manufacturing.

The kits also use methods intended to make analysis harder. Proofpoint observed CoGUI and CoAceV send visitors to unrelated decoy sites when browsing conditions do not match what the operators expect.

This can prevent automated security tools from seeing the real phishing page. The approach is similar in purpose, though not necessarily in technical design, to the fake CAPTCHA flow described in Cyber Security News’ report on Basic Auth URLs used in phishing.

The recent disruption targeted infrastructure and services supporting the phishing activity, rather than proving that every related domain or campaign has stopped.

Proofpoint says the action is likely to create operational problems for the operators and affect the wider Chinese-language phishing ecosystem. The outcome will depend on whether the groups rebuild their infrastructure, change their kits or move to other services.

For banks and other organizations, practical steps include checking email links and domain names, using multi-factor authentication, and monitoring for unusual sign-ins or changes to customer accounts. Security teams should also review reported phishing URLs quickly and share confirmed indicators with relevant partners.

For individuals, avoid signing in through links in unexpected messages; instead, open the bank’s official app or type its known address into the browser.

A similar Japan-focused credential theft case affecting investors is covered in Cyber Security News’ report on a phishing campaign targeting Monex investors.

Indicators of compromise (IoCs):-

Indicator type	Indicator	Associated kit
URL	hxxps://kenandy[.]shop/paidy/ubmisionsjp/	CoGUI
URL	hxxps://paidy[.]farradae.com/paidy/ubmissionsjp	CoAceV
URL	hxxps://lygyaou[.]com/9AioLNhtdi.kumamoto-city[.]jp	CoGUI
URL	hxxps://ylhgkj[.]com/BCuXkTPfKZ.kumamoto-city[.]jp	CoAceV
URL	hxxps://new-app-haixing[.]com/1DWSd1DeDf.kumamoto-city[.]jp	CoFish_Ws

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.