“Plus de 172 millions de messages” : mise en lumière de #CoGUI, exploité dans les campagnes de #phishing dont Amazon, PayPay ou encore Rakuten !

https://blog.sosordi.net/2025/05/plus-de-172-millions-de-messages-mise-en-lumiere-de-cogui-exploite-dans-les-campagnes-de-phishing-dont-amazon-paypay-ou-encore-rakuten.html

#securite #data #Internet #smishing

#CoGUI #phishing platform sent 580 million emails to steal credentials

https://www.bleepingcomputer.com/news/security/cogui-phishing-platform-sent-580-million-emails-to-steal-credentials/

#cybersecurity

UrlScan article on Oriental Gudgeon seems to be on the same campaign than the Proofpoint article on CoGUI, cn domains are in both IoC lists.

#phaas #threatintel #Cogui

https://www.proofpoint.com/us/blog/threat-insight/cogui-phish-kit-targets-japan-millions-messages
https://urlscan.io/blog/2025/05/06/oriental-gudgeon/

🚨 New threat research from Proofpoint 🚨

We have observed a notable increase in high-volume Japanese language campaigns targeting organizations in #Japan to deliver a phishing kit that Proofpoint researchers refer to as #CoGUI.

Blog: https://www.proofpoint.com/us/blog/threat-insight/cogui-phish-kit-targets-japan-millions-messages?utm_medium=social_organic

Most of the observed campaigns impersonate well-known companies, mainly consumer and finance brands, with the objective of stealing usernames, passwords and payment data.

CoGUI has some similarities to a phishing kit known as Darcula. Both are used by Chinese-speaking threat actors.

Notably, Proofpoint observed more finance-related #CoGUI campaigns in April 2025 following the reciprocal #tariff announcement by the U.S. government, and some CoGUI campaigns have used tariff-themed lures.

The CoGUI kit has several advanced defense evasion techniques. Proofpoint has created detections and Emerging Threats rules to combat this activity.

See our blog for full campaign details, examples, Emerging Threat detections and IOCs.