When Three Threats Meet One Inbox Against Japan

This report analyzes three concurrent Japan-focused threats—CoGUI (large-scale Chinese-language phishing kit), Smishing Triad (Lighthouse/Darcula smishing franchise), and MirrorFace/Earth Kasha (APT-associated spearphishing and implants)—documenting their TTPs, infrastructure overlap, IoCs (domains, IPs, SHA256 hashes), and recommended defensive priorities (behavioral detections over short-lived IoCs). It highlights high operational scale and sophistication, the delivery advantage of iMessage in Japan, cultural disclosure risks that lengthen dwell time, and the critical open question of a shared Japanese localization-as-a-service that could multiply impact if disrupted.