マイクロソフトは警察庁などと連携し、詐欺メッセージを支える中国語圏のサイバー犯罪市場を調査。Health-ISACとともにYAM Store、CoGUI、Iron Manのドメインを差し押さえました。

Microsoft and Health-ISAC are disrupting YAM Store, CoGUI and Iron Man, services that enabled more than one billion malicious messages targeting organizations worldwide.

Microsoft uncovered a criminal marketplace called YAM Store, tracked as Storm-3119, that supplied phishing tools and accounts used in scams worldwide. The operation involved three phishing kits, including one called CoGUI (also known as NX), which were sold through this underground marketplace. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT sectors across Japan, the United States, Australia, and India. Microsoft worked with Resecurity to identify the marketplace and the phishing kits being sold. The network was responsible for more than a billion scam messages.

Microsoftは日本の警察庁と連携し、中国語圏のサイバー犯罪「アプリストア」に対処YAM Store、CoGUI、Iron Manは150カ国以上の人々を標的にMicrosoftは世界各国の法執行機関と協力し、企業や個人を狙う違法な活動の摘発を進めるMicrosoftは、日本の警察庁と共同で実施した作戦により

Microsoft has used a US court order to hit a marketplace and two kits behind a billion phishing messages. What the services were, why it is a civil seizure rather than an arrest, and what to check in your own Microsoft 365 tenant.

📰 Source : Risky Business (Tom Uren), publié le 22 octobre 2026. Cet article de newsletter hebdomadaire couvre plusieurs incidents et tendances majeures en cybersécurité.

Une opération vise CoGUI et deux kits de phishing, avec saisies de domaines et action judiciaire.

A US court order let Microsoft and Health-ISAC seize domains behind YAM Store, CoGUI and Iron Man, services that sold scammers accounts and fake bank sites.

Microsoft and Health-ISAC have seized and redirected domains behind three Chinese-language cybercrime services, YAM Store, CoGUI and Iron Man, Microsoft said on Wednesday. Since January 2026, the...

Microsoft, Health-ISAC, and international partners have disrupted a major Chinese-language Phishing-as-a-Service (PhaaS) marketplace targeting healthcare.

Une opération vise CoGUI et deux kits de phishing, avec saisies de domaines et action judiciaire.

A court-backed operation targeted YAM Store, CoGUI and Iron Man, phishing services Microsoft linked to campaigns against more than 75,000 organizations.

Microsoft and international partners have disrupted infrastructure supporting CoGUI. This phishing kit Proofpoint says generates more than 100 million malicious emails monthly.

Microsoft vient de mettre un terme aux activités de YAM Store, CoGUI et Iron Man, les trois faces d'un vaste marché cybercriminel chinois. Depuis janvier 2026, ces plateformes pirates ont permis d'env...

A large Chinese-language phishing operation has used around 17,000 internet domains to impersonate banks, payment services, retailers and other well-known brands, with Japan as its main target. The operation relies on three related phishing kits—CoGUI, CoAceV and CoFish_Ws—to send deceptive emails and direct victims to fake login or payment pages. The findings come as security companies and law-enforcement partners disrupt parts of the wider fraud network. Microsoft and Health-ISAC filed a civil lawsuit against people linked to the operation and seized or redirected domains connected to YAM Store, CoGUI and Iron Man. The action involved public- and private-sector partners, including Proofpoint, Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle and TRM Labs. Researchers from Proofpoint identified the CoGUI activity toward the end of 2024 and later tracked two related kits, CoAceV and CoFish_Ws. Proofpoint assesses with high confidence that the three kits share roots and are used by overlapping affiliates. Splash page shown to visitors of malicious sites (Source – Proofpoint) The researchers say their campaigns have impersonated 66 brands, most of them Japanese, and have sent messages at a scale that puts financial accounts and personal data at risk. Chinese Phishing Network Uses 17,000 Domains Proofpoint counted 13,586 domains associated with CoGUI, 2,812 with CoAceV and 191 with CoFish_Ws. Together, the kits used around 17,000 unique domains over the period the researchers tracked them. The groups also rotate infrastructure: between July 1 and September 17, 2026, Proofpoint observed 3,788 unique fully qualified domain names, or FQDNs. An FQDN is the complete domain name used to reach a specific host on the internet. Phishing kit Campaigns observed Unique domains observed CoGUI 1,081 13,586 CoAceV 242 2,812 CoFish_Ws 19 191 The totals show why defenders cannot rely on blocking a short list of fixed web addresses. Frequent domain changes give campaigns room to keep running after some sites are identified or removed. The operation’s scale also connects to a wider ecosystem: Microsoft data cited by Proofpoint says YAM Store, CoGUI and Iron Man enabled more than one billion malicious messages targeting over 75,000 organizations worldwide since January 2026. The emails use themes such as bank account updates, payment details, credit cards, shopping orders and delivery notices. Their links can lead through filtering steps, including CAPTCHA checks, before opening a page that copies a trusted company’s login or payment portal. The fake pages then ask users to enter account details. This resembles tactics described in Cyber Security News’ earlier report on the CoGUI phishing kit and brand impersonation , which also documented attempts to collect credentials and payment-card data. The brands named by Proofpoint include PayPay, MyJCB, Rakuten, SMBC, Aeon Card, UC Card, Matsui Securities, Amazon, Apple, DHL and Yamato Transport. How the phishing pages steal information Most observed activity affected Japan, though Proofpoint also reported campaigns touching the United States, Australia and Italy. Financial services and healthcare were the most frequently affected sectors in its data, followed by government, education and manufacturing. The kits also use methods intended to make analysis harder. Proofpoint observed CoGUI and CoAceV send visitors to unrelated decoy sites when browsing conditions do not match what the operators expect. This can prevent automated security tools from seeing the real phishing page. The approach is similar in purpose, though not necessarily in technical design, to the fake CAPTCHA flow described in Cyber Security News’ report on Basic Auth URLs used in phishing . CAPTCHA used in a CoFish_ws campaign (Source – Proofpoint) The recent disruption targeted infrastructure and services supporting the phishing activity, rather than proving that every related domain or campaign has stopped. Proofpoint says the action is likely to create operational problems for the operators and affect the wider Chinese-language phishing ecosystem. The outcome will depend on whether the groups rebuild their infrastructure, change their kits or move to other services. For banks and other organizations, practical steps include checking email links and domain names, using multi-factor authentication, and monitoring for unusual sign-ins or changes to customer accounts. Security teams should also review reported phishing URLs quickly and share confirmed indicators with relevant partners. For individuals, avoid signing in through links in unexpected messages; instead, open the bank’s official app or type its known address into the browser. A similar Japan-focused credential theft case affecting investors is covered in Cyber Security News’ report on a phishing campaign targeting Monex investors . Indicators of compromise (IoCs):- Indicator type Indicator Associated kit URL hxxps://kenandy[.]shop/paidy/ubmisionsjp/ CoGUI URL hxxps://paidy[.]farradae.com/paidy/ubmissionsjp CoAceV URL hxxps://lygyaou[.]com/9AioLNhtdi.kumamoto-city[.]jp CoGUI URL hxxps://ylhgkj[.]com/BCuXkTPfKZ.kumamoto-city[.]jp CoAceV URL hxxps://new-app-haixing[.]com/1DWSd1DeDf.kumamoto-city[.]jp CoFish_Ws Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials appeared first on Cyber Security News .

Microsoftと国際的なパートナーが、フィッシングキット「CoGUI」を支えるインフラを妨害しました。Proofpointによると、このキットは月間1億通を超える悪意あるメールを生み出しています。 今回の共同対応は、中国語圏の詐欺エコシステムを標的にしたものです。このエコシステムには、関連するフィッシングキットや

Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI and Iron Man, services that enabled over 1…