The messages include a URL that redirects to a phishing website hosted on the CoGUI phishing platform, but the link only resolves if the target meets specific criteria pre-defined by the attackers. A new phishing kit named 'CoGUI' sent over 580 million emails to targets between January and April 2025, aiming to steal account credentials and payment data. Proofpoint researchers who discovered the CoGUI campaigns noted that it's the highest volume phishing campaign they currently track. The analysts found several similarities to the Darcula phishing kit, which has been linked to China-based operatives, and initially believed that the origin of the CoGUI attacks is the same. Valid targets are redirected to a phishing page featuring a fake login form that mimics the design of the real brand, tricking victims into entering their sensitive information. Proofpoint has also found that CoGUI was behind smishing campaigns targeting the United States with 'outstanding toll payment' lures. The attack starts with a phishing email impersonating a trusted brand, often having urgent subject lines requiring the recipient's action. The best way to mitigate phishing risks is never to act with haste when receiving emails requesting urgent action, and always log in to the claimed platform independently instead of following embedded links. However, upon deeper examination, Proofpoint concluded that the two phishing kits are unrelated even though they are both utilized by Chinese threat actors. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. The researchers believe CoGUI facilitates the operations of multiple threat actors, primarily from China, who predominantly target Japanese users. CoGUI has been active since at least October 2024, but Proofpoint started tracking it in December and onward. The attacks mainly target Japan, though smaller-scale campaigns were also directed at the United States, Canada, Australia, and New Zealand.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 07 May 2025 18:30:00 +0000