Loading malware…
CoFish_Ws is a credential- and payment-information phishing kit used in Chinese-language cybercriminal operations primarily targeting Japan. It shares common roots with CoGUI and CoAceV, and the three kits are used by overlapping affiliates. CoFish_Ws campaigns distribute deceptive emails that direct recipients to counterfeit login and payment pages. Observed examples impersonate the Japanese financial services company JACCS and request account credentials and credit card information. CAPTCHA gates filter visitors before exposing the phishing pages, helping obstruct automated analysis.
The associated campaigns use banking, payment-account, credit-card, shopping, and delivery themes to impersonate trusted organizations. Proofpoint documented 19 CoFish_Ws campaigns involving 191 unique domains. Across the three related kits, targeting predominantly affected Japan, with additional activity reaching the United States, Australia, and Italy. Financial services and healthcare were the most frequently affected sectors in the combined campaign data, followed by government, education, and manufacturing.
CoFish_Ws belongs to the broader CoGUI phishing ecosystem, whose supporting infrastructure was investigated during a coordinated public-private disruption involving Microsoft, Health-ISAC, Proofpoint, and other partners. Domain seizures and redirections targeted ecosystem infrastructure, but do not establish that all CoFish_Ws campaigns ceased.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.