The action targeted CoGUI and related phishing operations, alongside infrastructure supporting YAM Store and Iron Man fraud activities This article explores phishing kits disruption. . Other partners included the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, and TRM Labs.

Three interconnected phishing kits The disruption encompassed CoGUI and two related kits named CoAceV and CoFish_Ws. Researchers identified 66 imposter brands, including Amazon, Apple, PayPay, Rakuten, SMBC, DHL, and Yamato Transport. From July 1 to September 17, 2026, researchers observed 3,788 unique fully qualified domain names, showcasing the operators’ capability to maintain and rotate extensive infrastructure. Emails exploit banking alerts, payment issues, retail notifications, and shipping updates to lure victims.

Embedded links lead them through filtering checks, sometimes including CAPTCHAs, before displaying fake login or payment pages.

Similarities included targeting patterns, URL paths, and decoy pages designed to hide phishing content from automated analysis. CAPTCHA employed in a CoFish_ws campaign (Source: Proofpoint) was also observed during April 13-17, 2026, using the same decoy page. According to Microsoft figures provided by Proofpoint, YAM Store, CoGUI, and Iron Man, over one billion malicious messages have targeted more than 75,000 organizations worldwide since January 2026.

Join 16,000 SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.