CoGUI phishing platform sent 580 million emails to steal credentials

A new phishing kit named 'CoGUI' sent over 580 million emails to targets between January and April 2025, aiming to steal account credentials and payment data. The messages impersonate major brands like Amazon, Rakuten, PayPal, Apple, tax agencies, and banks. The activity culminated in January 2025, where 170 campaigns sent 172,000,000 phishing messages to targets, but the following months maintained equally impressive volumes. Proofpoint researchers who discovered the CoGUI campaigns noted that it's the highest volume phishing campaign they currently track. The attacks mainly target Japan, though smaller-scale campaigns were also directed at the United States, Canada, Australia, and New Zealand. CoGUI has been active since at least October 2024, but Proofpoint started tracking it in December and onward. Phishing email volumes generated by CoGUI Source: Proofpoint The analysts found several similarities to the Darcula phishing kit, which has been linked to China-based operatives, ... Read full article.