Microsoft and Health-ISAC Seize Domains in Phishing Network Takedown
A joint operation dismantled infrastructure linked to over one billion malicious messages, seizing domains used by CoGUI and related phishing kits targeting Japanese banks.
Key points
- Microsoft and Health-ISAC filed a civil lawsuit and seized domains linked to YAM Store, CoGUI, and Iron Man services.
- Proofpoint researchers identified three related phishing kits—CoGUI, CoAceV, and CoFish_Ws—using approximately 17,000 unique domains.
- The operation targeted 66 brands, primarily in Japan, with deceptive emails impersonating banks, retailers, and payment services.
Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) have filed a civil lawsuit against individuals linked to a massive phishing infrastructure. This legal action resulted in the seizure or redirection of domains connected to the YAM Store marketplace, the CoGUI phishing kit, and the Iron Man service. The operation disrupted tools that enabled more than one billion malicious messages sent since January 2026, according to Microsoft data cited by Proofpoint.
The takedown involved a coalition of public and private sector partners. Participants included Proofpoint, the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, and TRM Labs. This joint effort builds on earlier reporting by Threat Times on October 15 and 16, 2026, regarding the dismantling of the YAM Store and its associated services. The coordinated action aims to disrupt the financial and operational capabilities of the network behind these campaigns.
Phishing Kit Infrastructure and Scale
Researchers from Proofpoint first identified CoGUI activity toward the end of 2024. They later tracked two additional kits, CoAceV and CoFish_Ws, assessing with high confidence that all three share common roots and are used by overlapping affiliates. Proofpoint counted 13,586 domains associated with CoGUI, 2,812 with CoAceV, and 191 with CoFish_Ws. Together, these kits utilized around 17,000 unique domains during the period researchers monitored them.
The groups frequently rotate their infrastructure to evade detection. Between July 1 and September 17, 2026, Proofpoint observed 3,788 unique fully qualified domain names (FQDNs). An FQDN is the complete domain name used to reach a specific host on the internet. This constant rotation allows campaigns to continue operating even after some sites are identified or removed by defenders, making static blocklists ineffective against such dynamic threats.
Targeting Japanese Banks and Brands
The phishing campaigns have impersonated 66 brands, most of which are based in Japan. The operation primarily targets banks, payment services, retailers, and other well-known companies. Deceptive emails use themes such as bank account updates, payment details, credit card notifications, shopping orders, and delivery notices. These messages direct victims to fake login or payment pages that copy the appearance of trusted company portals.
The fake pages often include filtering steps, such as CAPTCHA checks, before opening the fraudulent interface. Once accessed, these pages prompt users to enter sensitive account details and credentials. The scale of the operation puts financial accounts and personal data at significant risk, as the kits are designed to steal login information and payment details from unsuspecting victims across multiple sectors.
What should you do?
Organizations should monitor for phishing emails that request urgent account updates or payment details, particularly those impersonating Japanese brands. Security teams should review logs for connections to newly registered domains or those with frequent infrastructure changes. Users should be trained to verify the legitimacy of login pages, especially after passing CAPTCHA checks, before entering credentials.
What to do and how to stay safe: Microsoft
- Verify the URL of any login page by manually typing the known address into your browser instead of clicking links in emails.
- Enable multi-factor authentication on all financial and corporate accounts to protect credentials even if they are stolen.
- Report suspicious emails to your security team immediately, providing headers and links for analysis rather than deleting them silently.
- Monitor financial statements and credit reports regularly for unauthorized transactions or new account openings that indicate identity theft.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What phishing kits are involved in this takedown?
The operation involved three related kits: CoGUI, CoAceV, and CoFish_Ws, which researchers believe share common roots.
How many domains were used by this network?
Proofpoint researchers identified approximately 17,000 unique domains used across the three phishing kits during their tracking period.
Which organizations participated in the takedown?
Partners included Microsoft, Health-ISAC, Proofpoint, Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, and TRM Labs.
