CoAceV

CoAceV is a credential-phishing kit used in high-volume email campaigns primarily targeting Japan. It is closely related to CoGUI and CoFish_Ws, sharing development roots and overlapping criminal affiliates within a Chinese-language phishing ecosystem. The kits impersonate banks, payment services, retailers, logistics providers, and other recognized brands to collect account credentials and payment-card information through counterfeit login and payment portals.

Campaigns use account-update requests, payment and credit-card notices, shopping orders, and delivery notifications as lures. Visitors may encounter CAPTCHA checks and other filtering before reaching fraudulent pages. CoAceV checks browsing conditions and redirects visitors that do not meet operator expectations to unrelated decoy sites, obstructing automated analysis. It adopted the same decoy-redirection method as CoGUI shortly after that technique appeared in CoGUI campaigns; the two kits also share decoy pages and URL-structure patterns.

Proofpoint documented 242 CoAceV campaigns involving 2,812 unique domains. Across the related three-kit operation, most activity affected Japan, with additional campaigns affecting the United States, Australia, and Italy. Financial services and healthcare were the most frequently affected sectors, followed by government, education, and manufacturing. A coordinated public-private disruption targeted infrastructure supporting the broader ecosystem, but did not establish that all CoAceV campaigns had ceased.