Chinese Phishing Network Targets Japanese Banks with 17,000 Domains

Key Takeaways

• A vast Chinese-language phishing network has launched campaigns utilizing approximately 17,000 domains.
• The primary targets are Japanese financial institutions, payment services, retailers, and other prominent brands.
• The operation leverages three interconnected phishing kits: CoGUI, CoAceV, and CoFish_Ws.
• The campaigns aim to steal financial account credentials and personal data through deceptive emails and fake login pages.
• A collaborative effort by law enforcement and cybersecurity firms has initiated disruptions against the network’s infrastructure.

A sophisticated Chinese-language phishing operation has deployed a massive infrastructure of nearly 17,000 internet domains to impersonate well-known Japanese banks, payment services, and retail brands. This extensive campaign aims to compromise financial accounts and steal sensitive personal data from unsuspecting victims.

The attackers primarily utilize three closely related phishing kits—CoGUI, CoAceV, and CoFish_Ws—to orchestrate their attacks. These kits facilitate the distribution of fraudulent emails that steer recipients toward meticulously crafted fake login or payment portals, designed to harvest credentials.

In response to this widespread threat, a coalition of cybersecurity companies and law enforcement agencies has commenced efforts to dismantle segments of the broader fraud network. This coordinated action includes a civil lawsuit filed by Microsoft and Health-ISAC against individuals allegedly linked to the operation, resulting in the seizure or redirection of domains associated with the YAM Store, CoGUI, and Iron Man kits. The disruption involved a collaborative effort from both public and private sector entities, including Researchers from Proofpoint identified, the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, and TRM Labs.

Proofpoint researchers initially identified CoGUI activity in late 2024 and subsequently tracked the emergence of two related kits, CoAceV and CoFish_Ws. Based on their analysis, Proofpoint confidently asserts that these three kits share common origins and are operated by an overlapping network of affiliates.

The research indicates that these campaigns have spoofed 66 distinct brands, predominantly Japanese entities. The sheer volume of malicious messages distributed poses a significant risk to individuals’ financial accounts and personal information.

Chinese Phishing Network Uses 17,000 Domains

Proofpoint’s investigation revealed a staggering number of domains linked to these kits: 13,586 for CoGUI, 2,812 for CoAceV, and 191 for CoFish_Ws. Cumulatively, the operation utilized approximately 17,000 unique domains during the tracking period.

The threat actors also employ a dynamic infrastructure rotation strategy. Between July 1 and September 17, 2026, Proofpoint observed 3,788 unique fully qualified domain names (FQDNs) in use. An FQDN represents the complete and unambiguous domain name for a specific host on the internet.

This rapid cycling of domains underscores the challenge faced by defenders who cannot rely solely on blocking static lists of malicious web addresses. The constant flux allows these campaigns to persist even after some of their infrastructure is identified and taken down.

The scale of this operation is also indicative of a broader criminal ecosystem. Data from Microsoft, cited by Proofpoint, reveals that the YAM Store, CoGUI, and Iron Man kits have collectively facilitated over one billion malicious messages targeting more than 75,000 organizations globally since January 2026.

The phishing emails leverage various lures, including notifications about bank account updates, payment issues, credit card alerts, shopping orders, and delivery statuses. The embedded links often lead victims through several filtering stages, including CAPTCHA checks, before presenting a convincing replica of a legitimate company’s login or payment portal.

Once on these fraudulent pages, users are prompted to enter their account credentials and other sensitive information. This tactic mirrors those previously documented in reports concerning the CoGUI phishing kit and brand impersonation, which also highlighted efforts to steal credentials and payment card data.

Among the prominent brands impersonated by these campaigns are PayPay, MyJCB, Rakuten, SMBC, Aeon Card, UC Card, Matsui Securities, Amazon, Apple, DHL, and Yamato Transport.

How the Phishing Pages Steal Information

While the majority of observed activity was concentrated in Japan, Proofpoint also identified campaigns extending to the United States, Australia, and Italy. Financial services and healthcare sectors were the most frequently targeted, followed by government, education, and manufacturing.

The phishing kits incorporate techniques designed to evade detection and analysis. Proofpoint noted that both CoGUI and CoAceV redirect visitors to unrelated decoy websites when the browsing environment does not align with the operators’ expectations. This mechanism effectively prevents automated security tools from accessing and analyzing the actual phishing pages. This approach shares a similar objective, though not necessarily an identical technical implementation, with the deceptive CAPTCHA flows detailed in previous reports on Basic Auth URLs used in phishing attacks.

The recent collaborative disruption primarily targeted the infrastructure and services supporting this phishing activity. It does not guarantee the complete cessation of every related domain or campaign. However, Proofpoint anticipates that these actions will create significant operational hurdles for the perpetrators and impact the broader Chinese-language phishing ecosystem. The long-term effectiveness of these disruptions will depend on the attackers’ ability to rebuild their infrastructure, modify their kits, or migrate to alternative services.

What You Should Do

• For Organizations:
  • Implement robust email filtering solutions to detect and block phishing attempts.
  • Educate employees regularly on identifying phishing emails, especially those impersonating common brands and services.
  • Enforce multi-factor authentication (MFA) across all critical systems and accounts.
  • Monitor for unusual login attempts or suspicious changes to customer accounts.
  • Establish a clear and rapid process for reporting and analyzing suspected phishing URLs, and share confirmed indicators of compromise (IoCs) with industry partners.
• For Individuals:
  • Exercise extreme caution with unexpected emails, particularly those requesting personal or financial information.
  • Never click on links within suspicious emails. Instead, navigate directly to the official website or open the official app of the bank or service in question.
  • Enable multi-factor authentication (MFA) on all your online accounts, especially banking and payment services.
  • Regularly check your bank and credit card statements for any unauthorized transactions.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.