Threat Summary
Three OTX pulses show the same industrial pattern: adversaries are converting trusted workflow brands into credential and device compromise pipelines. The first campaign spoofs Calendly booking flows for Meta Careers interviews, moving victims from time-slot selection to fake CAPTCHA and then to Facebook and Google login panels. Tags explicitly call out 2FA bypass and account takeover, so treat this as session-token theft and adversary-in-the-middle phishing rather than simple password harvesting.
The second pulse is materially higher severity: Citizen Lab-linked reporting attributes AdFection activity to Caramel Tsunami, Candiru spyware, Discover-Tech, and the Controlium platform. The reported chain uses real-time bidding and targeted ads as a delivery pipeline for zero-click exploitation, with CVEs including CVE-2021-21166, CVE-2021-30551, CVE-2021-31979, CVE-2021-33742, and CVE-2021-33771. Targeting spans government, media, defense, telecom, energy, finance, technology, and education across dozens of countries.
The third pulse documents disruption of Chinese-language phishing kit operations branded CoGUI, CoAceV, and CoFish_Ws, associated with YAM Store and focused heavily on Japanese organizations while also touching the US, Australia, and Italy. The kits impersonated 66 consumer and finance brands and generated hundreds of millions of messages. Sample infrastructure uses lookalike paths such as /paidy/ubmisionsjp/ and hostnames embedding kumamoto-city.jp to localize lures. Collectively: recruitment trust, ad-tech trust, and brand trust are being abused to steal identities at scale and, in the Candiru case, deliver mercenary spyware.
Threat Actor / Malware Profile
- Fake Calendly Meta Careers kit: distribution is through fraudulent domains such as joinconnect.cfd, joinconnect.works, joinhire.cfd, joinhire.info, joinquest.cfd, joinquest.info, joinquest.works, and jointhetalent.cfd. Payload behavior is browser-based credential capture against Facebook and Google, with fake CAPTCHA used to increase legitimacy and filter bots. Likely C2 is the phishing backend itself, relaying credentials or session cookies to operator panels. Persistence is achieved downstream through account takeover, OAuth consent abuse, mailbox rules, and recovery-option changes rather than endpoint implants. Anti-analysis includes CAPTCHA gates, short-lived domains, brand cloning, and selective victim routing.
- Candiru / Discover-Tech / Controlium / Caramel Tsunami: distribution is malicious ad inventory purchased or brokered through Discover-Tech, converting targeted advertising into zero-click delivery. Payload behavior is mercenary spyware for surveillance against high-value devices and organizations. C2 uses layered infrastructure including hostnames such as api-docs.freewheel.tv and domains such as rockhoster.com and volasim.com. Persistence on mobile or desktop typically relies on exploit-mediated privilege escalation and stealthy implant components; assume credential, message, microphone, location, and browser data access. Anti-analysis includes exploit chain obfuscation, victim fingerprinting, RTB targeting constraints, and encrypted C2.
- CoGUI, CoAceV, CoFish_Ws: distribution is high-volume phishing messages impersonating consumer, finance, healthcare, government, education, and manufacturing brands, with Japanese localization. Payload behavior is credential and payment data theft through cloned login and billing pages. C2 is the kit panel and drop infrastructure behind domains such as lygyaou.com, kenandy.shop, new-app-haixing.com, paidy.farradae.com, and ylhgkj.com. Persistence is primarily victim-account compromise and resale through criminal ecosystems. Anti-analysis includes generated URL paths, brand-specific routing, disposable domains, and takedown-resistant template reuse.
IOC Analysis
The indicator set is dominated by domains, hostnames, URLs, and CVEs; there are no file hashes in the sample, so detection should emphasize network egress, browser, email, and identity telemetry. Domains ending in .cfd, .works, .info, and .shop with recruitment or hiring verbs are high-confidence phishing candidates in context. URLs containing paidy, ubmisionsjp or ubmissionsjp, kumamoto-city.jp, and randomized path prefixes indicate CoGUI/CoAceV/CoFish-style localization. Hostnames that mimic legitimate vendor documentation, such as api-docs.freewheel.tv, should be treated as suspicious when observed from endpoints without an approved business purpose. CVEs should drive exposure management for Chrome, Edge, WebView2, mobile browsers, and OS components rather than simple blocking.
SOC operationalization: push domains and URLs into DNS, proxy, secure web gateway, EDR network block, email URL rewriting, and threat-intel platforms. Add retro-hunts across 30-90 days for joins to hiring-themed domains, RTB anomalies, and Japanese finance lures. Use URLScan, VirusTotal, OTX pulse pivoting, Passive DNS, Certificate Transparency logs, and browser isolation verdicts to expand infrastructure. For suspected Candiru exposure, preserve devices for forensic analysis and coordinate with legal, comms, and executive protection before destructive remediation.
Detection Engineering
---
title: OTX Hiring-Themed Phishing Domain Resolution
date: 2026/10/15
status: experimental
description: Detects DNS or proxy access to fake Calendly and Meta Careers phishing infrastructure using .cfd, .works, and .info hiring lures.
logsource:
category: dns
product: zeek
service: dns
detection:
selection_query:
query|contains:
- 'joinconnect.cfd'
- 'joinconnect.works'
- 'joinhire.cfd'
- 'joinhire.info'
- 'joinquest.cfd'
- 'joinquest.info'
- 'joinquest.works'
- 'jointhetalent.cfd'
selection_pattern:
query|re: '(?i)(join(connect|hire|quest|thetalent)\.(cfd|works|info)|calendly.*meta|meta.*career.*(cfd|works|info))'
condition: selection_query or selection_pattern
falsepositives:
- Security research, threat intel enrichment, isolated browser analysis
level: high
tags:
- attack.initial_access
- attack.t1566.002
- attack.t1071.001
---
title: OTX AdFection Candiru Zero-Click Browser Exploit Behavior
date: 2026/10/15
status: experimental
description: Detects suspicious browser or WebView exploitation behavior consistent with zero-click spyware delivery via malicious ads and CVE-2021-21166, CVE-2021-30551, CVE-2021-31979, CVE-2021-33742, CVE-2021-33771 exposure.
logsource:
category: process_creation
product: windows
detection:
selection_browser_parent:
ParentImage|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\msedgewebview2.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wmic.exe'
- '\cmd.exe'
- '\mshta.exe'
selection_network:
CommandLine|contains:
- 'freewheel.tv'
- 'rockhoster.com'
- 'volasim.com'
- 'controlium'
- 'candiru'
condition: selection_browser_parent and (selection_child or selection_network)
falsepositives:
- Browser troubleshooting, enterprise webview apps, approved automation
level: critical
tags:
- attack.initial_access
- attack.t1203
- attack.t1059
- attack.t1071
---
title: OTX CoGUI CoAceV CoFish Japanese Finance Phish URL
date: 2026/10/15
status: experimental
description: Detects proxy, DNS, or email URL artifacts matching Chinese-language phishing kits targeting Japanese brands with Paidy and kumamoto-city.jp lures.
logsource:
category: proxy
detection:
selection_host:
c-uri-host|contains:
- 'lygyaou.com'
- 'kenandy.shop'
- 'new-app-haixing.com'
- 'paidy.farradae.com'
- 'ylhgkj.com'
selection_uri:
c-uri|re: '(?i)(paidy|ubmisionsjp|ubmissionsjp|kumamoto-city\.jp|[A-Za-z0-9]{10}\.kumamoto-city\.jp)'
condition: selection_host or selection_uri
falsepositives:
- Research sandboxes, brand-protection crawlers
level: high
tags:
- attack.initial_access
- attack.t1566
- attack.t1598
let phishing_domains = dynamic(["joinconnect.cfd","joinconnect.works","joinhire.cfd","joinhire.info","joinquest.cfd","joinquest.info","joinquest.works","jointhetalent.cfd","lygyaou.com","kenandy.shop","new-app-haixing.com","paidy.farradae.com","ylhgkj.com","rockhoster.com","volasim.com"]);
let phishing_hosts = dynamic(["api-docs.freewheel.tv"]);
let url_regex = @"(?i)(paidy|ubmisionsjp|ubmissionsjp|kumamoto-city\.jp|join(connect|hire|quest|thetalent)\.(cfd|works|info))";
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| extend RemoteHost = tostring(parse_url(RemoteUrl).Host)
| where RemoteHost in (phishing_domains) or RemoteHost in (phishing_hosts) or RemoteUrl matches regex url_regex or RemoteHost has_any (phishing_domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteHost, RemoteIP, ActionType),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (InitiatingProcessFileName has_any ("chrome.exe","msedge.exe","firefox.exe","msedgewebview2.exe") and FileName in~ ("powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","wmic.exe","cmd.exe","mshta.exe"))
or ProcessCommandLine has_any ("freewheel.tv","rockhoster.com","volasim.com","joinquest","joinhire","paidy","kumamoto-city.jp")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256),
(EmailUrlInfo
| where TimeGenerated > ago(14d)
| where Url matches regex url_regex or UrlDomain has_any (phishing_domains)
| project TimeGenerated, Url, UrlDomain, NetworkMessageId)
| sort by TimeGenerated desc
$ErrorActionPreference = 'SilentlyContinue'
$domains = @('joinconnect.cfd','joinconnect.works','joinhire.cfd','joinhire.info','joinquest.cfd','joinquest.info','joinquest.works','jointhetalent.cfd','lygyaou.com','kenandy.shop','new-app-haixing.com','paidy.farradae.com','ylhgkj.com','rockhoster.com','volasim.com','api-docs.freewheel.tv')
$regex = '(?i)(paidy|ubmisionsjp|ubmissionsjp|kumamoto-city\.jp|join(connect|hire|quest|thetalent)\.(cfd|works|info)|freewheel\.tv|rockhoster\.com|volasim\.com)'
Write-Host '[+] DNS cache matches'; Get-DnsClientCache | Where-Object {$_.Entry -match $regex -or $_.Name -match $regex} | Select-Object Entry,Name,Data | Format-Table -AutoSize
Write-Host '[+] Active and recent TCP endpoints'; Get-NetTCPConnection | Where-Object {$_.RemoteAddress -ne $null} | ForEach-Object { $ip=$_.RemoteAddress; try { $h=[System.Net.Dns]::GetHostEntry($ip).HostName } catch { $h='' }; if ($h -match $regex) { [pscustomobject]@{RemoteIP=$ip; HostName=$h; State=$_.State; OwningProcess=$_.OwningProcess; Process=(Get-Process -Id $_.OwningProcess).ProcessName} } } | Format-Table -AutoSize
Write-Host '[+] Hosts file overrides'; Get-Content "$env:windir\System32\drivers\etc\hosts" | Where-Object {$_ -match $regex}
Write-Host '[+] Browser cache and history artifacts'; $paths = @("$env:LOCALAPPDATA\Google\Chrome\User Data","$env:LOCALAPPDATA\Microsoft\Edge\User Data"); foreach ($p in $paths) { Get-ChildItem $p -Recurse -Include 'History','Cache','Cookies' -ErrorAction SilentlyContinue | Select-Object -First 50 FullName,LastWriteTime }
Write-Host '[+] Suspicious persistence and browser-spawned tasks'; Get-ScheduledTask | Where-Object {$_.Actions.Execute -match '(?i)(powershell|rundll32|mshta|regsvr32|wmic)' -or $_.TaskName -match '(?i)(update|sync|ad|media|browser)'} | Select-Object TaskName,TaskPath,State | Format-Table -AutoSize
Write-Host '[+] WebView2 and browser processes'; Get-CimInstance Win32_Process | Where-Object {$_.Name -match '(?i)(chrome|msedge|firefox|msedgewebview2)' -and $_.CommandLine -match $regex} | Select-Object ProcessId,Name,CommandLine | Format-List
Response Priorities
- Immediate: block the listed domains, hostnames, and URL regexes at DNS, proxy, SWG, EDR network controls, and email rewriting. Isolate endpoints with DNS cache or process hits. Preserve volatile memory and browser artifacts for any executive, journalist, government, defense, telecom, or finance user matching Candiru targeting. Force password resets and revoke sessions for users who entered credentials into hiring or Paidy lures.
- 24h: because credential theft and 2FA bypass are explicit, verify identity using out-of-band channels, revoke OAuth grants, invalidate refresh tokens, review mailbox rules and forwarding, audit MFA registration changes, and rotate exposed API keys. For possible AdFection exposure, assume device compromise until proven otherwise; check patch levels for the listed CVEs across Chrome, Edge, WebView2, Android System WebView, iOS, and mobile device fleets.
- 1 week: harden architecture by moving high-risk users to hardware-backed phishing-resistant MFA, restricting RTB/ad traffic for sensitive cohorts, enabling browser isolation for recruitment and finance workflows, blocking newly registered and free TLD domains by policy, tuning detections for browser-spawned LOLBins, and implementing brand-impersonation monitoring for Japanese payment and municipal lures.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.