COGUI PHISHING PLATFORM SENT 580M EMAILS TO STEAL CREDENTIALS

Summary from the TLDR InfoSec newsletter

A new phishing kit called CoGUI was used to send over 580M emails to targets between January and April. The attack chain begins with an email impersonating a legitimate site with an urgent subject line. The email includes a link that checks if the victim's machine matches a series of criteria such as IP, browser language, OS, etc, and presents a fake login page if the criteria match or redirects the victim to the legitimate site if not. CoGUI is the largest volume phishing campaign Proofpoint is tracking.