CoGUI Phish Kit Targets Japan with Millions of Messages
Essential information
- Published
- 06/05/2025 20:37
- Modified
- 06/05/2025 21:41
- Tags
- 2025-05-06 brand impersonation cogui credential-theft darcula phishing
- Related entities
- 7 observables, 9 techniques (mitre), 1 malware, 7 others
Description
A sophisticated phishing kit named CoGUI is targeting Japanese organizations with high-volume campaigns, primarily impersonating consumer and finance brands to steal credentials and payment data. The kit employs advanced evasion techniques like geofencing and fingerprinting to avoid detection. Since October 2024, CoGUI campaigns have sent millions of messages monthly, peaking at 172 million in January 2025. While mainly focused on Japan, some campaigns have targeted other countries. The kit shares similarities with Darcula, another phishing framework used by Chinese-speaking actors. CoGUI's activity aligns with recent warnings from Japanese financial authorities about increased phishing attacks leading to financial theft.