Australia targeted in massive phishing network takedown

Australia has been identified as a key target in a phishing ecosystem disrupted by Microsoft, Health-ISAC, Proofpoint and other partners. The campaign also heavily targeted Japan and the United States, according to Proofpoint.

The operation centred on three related phishing kits - CoGUI, CoAceV and CoFish_Ws - which researchers linked to a broader Chinese-language fraud network. Microsoft said the wider ecosystem generated more than 1 billion malicious messages aimed at more than 75,000 organisations worldwide. Proofpoint said it blocks more than 100 million emails a month tied to CoGUI alone.

Proofpoint data shows Australian organisations in Financial Services and Healthcare were affected most often, followed by Government, Education and Manufacturing. Most of the campaigns it tracked were aimed at Japan, but Australia, the US and Italy were also among the targets.

The disruption combined technical takedowns with legal action. Microsoft and Health-ISAC filed a civil case against actors linked to the phishing operation, while domains associated with YAM Store, CoGUI and Iron Man were seized and redirected.

How it worked

The phishing kits impersonated consumer, finance and logistics brands to trick users into surrendering usernames, passwords and payment details. Proofpoint observed 66 brands being copied, including Amazon, Apple, DHL, Rakuten and several Japanese card and banking brands.

Researchers described the infrastructure as extensive and fast-moving. Across the three kits, they tracked about 17,000 unique domains, with operators frequently rotating addresses to sustain campaigns and reduce detection.

The messages typically directed recipients to malicious links that passed through screening steps before reaching fake login or payment pages. Proofpoint said the kits used CAPTCHA checks and decoy pages to keep automated analysis systems away from credential-harvesting pages.

Proofpoint also identified overlaps between the three toolsets, including common URL patterns, shared decoy methods and similar campaign timing. It said those links support its assessment, made with high confidence, that the kits have common roots and are used by overlapping affiliates.

Australian exposure

The focus on Financial Services in Australia matches the wider pattern identified by researchers. Proofpoint said the threat actors appeared particularly interested in access to financial accounts, and cited reporting from Japan linking phishing proceeds to the purchase of Chinese stocks.

That matters because successful account takeovers can expose businesses and institutions to direct theft, fraud losses and operational disruption. Healthcare, Government and Education also hold large stores of personal data, making them recurring targets for credential phishing campaigns.

Proofpoint first identified the cluster of phishing activity toward the end of 2024, when it observed sustained high-volume campaigns directed at Japan. It later published research on CoGUI and said the kit's developer appeared to respond by altering network communications, a move researchers interpreted as a reaction to public scrutiny.

Over time, two related kits emerged and expanded the network. Campaign data cited by Proofpoint showed CoGUI was by far the largest of the three, accounting for 1,081 campaigns and 13,586 unique domains, compared with 242 campaigns and 2,812 domains for CoAceV, and 19 campaigns and 191 domains for CoFish_Ws.

Scale of the threat

The volume figures help explain why the operation prompted coordination between technology companies, security groups and public agencies. Proofpoint said threats linked to these kits were among the highest-volume direct email attacks in its data, while Microsoft described the broader ecosystem as responsible for one of the world's largest flows of malicious email.

Proofpoint said the takedown is likely to disrupt the phishing kits by increasing operational friction for the groups behind them. It contributed threat data, including malicious domains and campaign details, to support the action.

"A disruption action targeting prominent players across the Chinese-speaking phishing and fraud ecosystem struck a blow to the highest-volume threats in Proofpoint data," said the Proofpoint Threat Research Team.

"The highest-volume direct email threats in Proofpoint campaign data come from three phishing kits our researchers named CoGUI, CoAceV and CoFish_Ws, which all actively target Japanese organisations," the team said.

"Campaigns linked to these phishing kits impersonate well-known companies, mainly consumer and finance brands, and distribute hundreds of millions of messages," the team said.

"Proofpoint assesses with high confidence that all these phishing kits have common roots and are used by overlapping affiliates," the team said.