When Three Threats Meet One Inbox Against Japan

Three distinct Chinese-linked threat actors—CoGUI, Smishing Triad, and MirrorFace—are simultaneously and independently targeting Japanese inboxes and devices with overlapping, highly localized phishing and espionage campaigns, creating the illusion of a single coordinated assault and underscoring the urgent need for durable, behavior-based detection over reliance on fleeting indicators.