Published on October 18, 2026
Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials
Severity
Medium
Detail
Proofpoint researchers have published an analysis detailing a massive, Chinese-language phishing operation that has utilized approximately 17,000 unique internet domains to impersonate 66 major brands, primarily targeting organizations and individuals in Japan. Driven by three related phishing kits—CoGUI, CoAceV, and CoFish_Ws—the campaign has successfully sent over one billion malicious messages targeting more than 75,000 organizations worldwide since January 2026.
This sprawling cybercrime ecosystem recently faced coordinated disruption efforts, including a civil lawsuit filed by Microsoft and Health-ISAC alongside international law enforcement and private partners (such as Proofpoint, Cloudflare, and the Japan Cybercrime Control Center) to seize and redirect domains linked to the YAM Store, CoGUI, and Iron Man infrastructure.
How?
The infrastructure relies on high-volume domain rotation, with Proofpoint identifying 13,586 domains associated with CoGUI, 2,812 with CoAceV, and 191 with CoFish_Ws. Between July and September 2026 alone, researchers observed nearly 3,800 unique fully qualified domain names (FQDNs), highlighting an operational model designed to evade static blocklists and security controls.
The end-to-end phishing lifecycle operates through several distinct stages:
- Deceptive Delivery: Affiliates distribute mass phishing emails utilizing themes such as bank account updates, credit card alerts, shopping order confirmations, and delivery notices. The messages frequently impersonate prominent Japanese and global brands, including PayPay, MyJCB, Rakuten, SMBC, Aeon Card, Amazon, Apple, and Yamato Transport.
- Evasion & Filtering: When a user clicks an email link, they are routed through filtering mechanisms—such as interactive CAPTCHA checks—to weed out automated scanners. Furthermore, CoGUI and CoAceV deploy conditional redirection techniques, routing automated analysis tools or non-targeted visitors to unrelated decoy sites to conceal the true phishing pages.
- Credential Harvesting: Once the user passes filters, they land on pixel-perfect replica login or payment portals designed to capture sensitive personal data, corporate credentials, financial accounts, and payment-card information.
Conclusion
This multi-kit phishing operation illustrates the sheer scale and resilience of modern, industrialized cybercrime infrastructure, combining thousands of rotating domains with advanced anti-analysis filtering. While recent domain seizures and legal actions by Microsoft, Health-ISAC, and security partners will cause substantial operational friction, threat actors are likely to adapt and rebuild their tooling.
To mitigate these threats, organizations must move beyond static URL blocklists, employing robust email authentication standards (SPF, DKIM, DMARC), advanced behavioral link-scanning, and strict multi-factor authentication (MFA) policies. Security teams should prioritize rapid triage of reported phishing URLs and share indicators across threat-intelligence frameworks.
For end users, defense relies on digital hygiene: avoiding direct login links found in unsolicited emails and instead navigating to official applications or typing known enterprise URLs directly into the browser.
Source