Proofpoint: CoGUI-family phishing kits target Japanese brands, IOC kenandy.shop

What happened

Cyber Security News reported on 16 October 2026 that Proofpoint researchers have tracked a large Chinese-language phishing operation using three related phishing kits, CoGUI, CoAceV and CoFish_Ws, with Japan as its main target. Proofpoint counted 13,586 domains associated with CoGUI, 2,812 with CoAceV and 191 with CoFish_Ws, about 17,000 in total, and observed 3,788 unique hostnames between July 1 and September 17, 2026 alone.

The campaigns have impersonated 66 brands, most of them Japanese, including PayPay, MyJCB, Rakuten, SMBC, Aeon Card, UC Card, Matsui Securities, Amazon, Apple, DHL and Yamato Transport. These brands are being spoofed and are not involved. The report comes as Microsoft and Health-ISAC filed a civil lawsuit and seized or redirected domains linked to the YAM Store, CoGUI and Iron Man operations, with partners including Proofpoint, Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle and TRM Labs.

Indicators of compromise listed in the article include hxxps://kenandy[.]shop/paidy/ubmisionsjp/ (CoGUI), paidy[.]farradae.com (CoAceV), lygyaou[.]com (CoGUI), ylhgkj[.]com (CoAceV) and new-app-haixing[.]com (CoFish_Ws).

How the scam works

The emails use themes such as bank account updates, payment details, credit cards, shopping orders and delivery notices. Links pass through filtering steps, including CAPTCHA checks, before opening a page that copies a trusted company's login or payment portal and asks for account details. CoGUI and CoAceV send visitors to unrelated decoy sites when browsing conditions don't match what the operators expect, which can hide the real phishing page from automated security tools.

Most activity affected Japan, though Proofpoint also saw campaigns touching the United States, Australia and Italy. The article notes the disruption does not prove every related domain or campaign has stopped. For individuals, it advises not signing in through links in unexpected messages and instead opening the bank's official app or typing its known address.

Source

Cyber Security News, "Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials" (16 October 2026), reporting Proofpoint research.