Proofpoint said it participated in a public-private effort led with Microsoft and Health-ISAC to disrupt phishing infrastructure associated with several Chinese-language phishing kits, with Japan among the principal targets.

The company identified three related kits—CoGUI, CoAceV and CoFish_Ws—which it assesses share common origins and overlapping affiliates. Proofpoint said the kits were involved in more than 1,300 campaigns using about 17,000 distinct domains.

Proofpoint reported blocking more than 100 million CoGUI-related emails a month and said the kits impersonated 66 brands, including Japanese banking, retail and logistics names, to steal credentials and payment-card data. These are telemetry-derived figures from Proofpoint, not a count of successful compromises.

Microsoft, according to Proofpoint’s summary of the disruption, has described a broader ecosystem responsible for more than one billion malicious messages targeting over 75,000 organizations since January 2026. The broader figures should not be attributed to the three Proofpoint-named kits alone.

Proofpoint said a connection to financial account-takeover activity described by Japan’s Financial Services Agency remains possible but unconfirmed.

Proofpoint’s Sumit Dhawan on AI security, data sovereignty and agentic risk [Q&A]