Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus

This campaign involved Chinese-speaking cybercriminals leveraging three major phishing kits—CoGUI, CoAceV, and CoFish_Ws—to conduct large-scale credential phishing primarily targeting Japanese organizations. The threat actors impersonated 66 prominent brands, mainly in consumer and finance sectors, to harvest sensitive credentials and payment information. They employed sophisticated operational security measures, including the use of approximately 17,000 unique domains with frequent rotation and evasion tactics. The disruption effort targeted not only the phishing kits but also their ecosystem enablers, YAM Store and Iron Man, through civil litigation and domain seizures. This coordinated effort was a collaboration between Microsoft, Health-ISAC, and multiple security partners, aiming to degrade the operational capabilities of these threat groups and reduce financial fraud activities.

The phishing campaigns facilitated large-scale credential theft and financial fraud targeting Japanese organizations, potentially compromising user accounts and payment data. The disruption action is expected to significantly impair the operational infrastructure of the involved threat groups, reducing their ability to conduct phishing attacks and financial fraud. The seizure of domains and legal actions against ecosystem enablers further constrains the threat actors' capabilities.

This disruption campaign represents an active law enforcement and industry effort to dismantle the phishing infrastructure. Organizations should remain vigilant against phishing attempts impersonating well-known consumer and finance brands, especially those targeting Japanese users. No direct patch or technical fix applies as this is a disruption of criminal infrastructure rather than a software vulnerability. Continued collaboration between industry and law enforcement is critical to sustain pressure on these threat actors.