Threat reportPhishingTL-2026-1818
LogoKit Phishing-as-a-Service Evolves to Real-Time "Environment Impersonation"
LogoKit Phishing-as-a-Service Evolves to Real-Time (TL-2026-1818), also tracked as LogoKit, is a medium-severity phishing campaign, first published 2026-08-02. It has no confirmed attribution, affects Microsoft SharePoint Online, maps to 17 MITRE ATT&CK techniques (T1027, T1036.005, T1041), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-1818
- Threat ID
- TL-2026-1818
- Also known as
- LogoKit, Environment Impersonation Phishing Kit
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise, technology, finance, cryptocurrency
- Target regions
- Global, North America, Europe, East Asia
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in LogoKit Phishing-as-a-Service Evolves to Real-Time
Malware and tooling: LogoKit, Starkiller, Telegram Bot API
How LogoKit Phishing-as-a-Service Evolves to Real-Time works
Barracuda Networks research (published 2026-07-29, author Sachin Meti) documents LogoKit — a phishing-as-a-service kit first named by RiskIQ in January 2021 — evolving from static brand impersonation into real-time "environment impersonation": it extracts the victim's email and employer domain from the phishing URL, pulls live website screenshots (Thum.io) and brand assets (Clearbit, Google Favicon, ImageKit, Microlink) to recreate the victim's actual corporate login page per-request, then exfiltrates harvested credentials to a Telegram bot and redirects the victim to the genuine site.
LogoKit is an embeddable, lightweight JavaScript phishing-kit family first identified and named by RiskIQ in January 2021, when researchers observed it running on more than 700 unique domains within a single 30-day window. The original kit worked by embedding the victim's email address in the phishing URL (typically in the location hash), fetching the target organization's logo from a third-party brand API (Clearbit or Google's favicon service), auto-filling the victim's email into the fake login form to build false familiarity, and exfiltrating any entered credentials via an AJAX request to an attacker-controlled or third-party endpoint before redirecting the victim to the real corporate site. It was distributed across a mix of compromised websites and abused legitimate cloud platforms (Firebase, GitHub Pages, Oracle Cloud), primarily impersonating Microsoft SharePoint, Adobe Document Cloud, OneDrive, and Office 365 login pages, as well as cryptocurrency-exchange portals. Some instances blocked browser keyboard shortcuts to hinder victims or analysts from inspecting page source.
Barracuda's July 2026 research documents a significant evolution of the same kit family: a shift from static "brand impersonation" (a fixed logo pasted onto a generic template) to dynamic "environment impersonation," where each phishing page is assembled at request time to closely mirror the victim's actual, real corporate web environment. The kit still extracts the victim's email address from the phishing URL and derives the employer's domain from it, but now uses that domain to drive a chain of legitimate third-party API calls: Thum.io generates a live, full-page screenshot of the victim's genuine corporate website to use as the phishing page's background; Clearbit supplies the matching brand logo; Google's favicon service and ImageKit load authentic supplementary imagery; and Microlink APIs pull additional real-time website content. Because every element of the page is fetched live and per-victim rather than baked into a static template, there is no fixed artifact for security vendors to fingerprint or blocklist, which materially raises the detection-evasion bar compared to the original 2021 kit.
The second major change is in the exfiltration path: rather than POSTing stolen credentials to an attacker-controlled backend server (the original kit's design, and a stable network indicator defenders could hunt and block), the 2026 variant routes harvested credentials through a Telegram bot. This removes the need for the operator to stand up or maintain dedicated C2 infrastructure and further reduces the forensic footprint, since Telegram Bot API traffic blends in with a huge volume of legitimate application traffic. As before, victims are redirected to the real target site immediately after submitting credentials, reinforcing the illusion that they simply mistyped their password rather than been phished. Barracuda's campaign sample included lures for password/certificate expiry, access restriction notices, delivery failures, timesheet updates, and ICANN verification notices, localized across English, German, French, Spanish, Chinese, and Korean, indicating a broad, internationally-targeted operation rather than a narrow regional campaign. No specific threat-actor group, nation-state sponsor, or CVE is associated with this report; LogoKit is sold/operated as a commodity phishing-as-a-service tool rather than being tied to a single named intrusion set, and industry coverage has informally referred to its operators as "the LogoKit group" without formal attribution.
From a defensive standpoint, Barracuda recommends phishing-resistant MFA (FIDO2 security keys, passkeys) as the most durable mitigation, since it neutralizes credential-only theft regardless of how convincing the impersonation is; conditional/risk-based access policies that weigh device trust and behavioral signals before honoring a login; browser isolation for links arriving from unverified senders; and automated URL/link analysis capable of flagging newly created domains and free/ephemeral app-hosting platforms (such as the glitch.me subdomain observed hosting a live LogoKit instance) at click time.
MITRE ATT&CK techniques used in TL-2026-1818
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Initial Access
T1078 Valid Accounts; T1566.002 Spearphishing Link
Execution
Resource Development
T1583.006 Web Services; T1584.001 Domains; T1585.001 Social Media Accounts; T1608.005 Link Target
Reconnaissance
T1589.002 Email Addresses; T1590.001 Domain Properties; T1598.003 Spearphishing Link
stealth
Affected products and versions in LogoKit Phishing-as-a-Service Evolves to Real-Time
- Microsoft — SharePoint Online
Vulnerable versions: N/A - brand/environment impersonation target, not a software vulnerability - Microsoft — OneDrive
Vulnerable versions: N/A - brand/environment impersonation target, not a software vulnerability - Microsoft — Office 365 / Microsoft 365 login portal
Vulnerable versions: N/A - brand/environment impersonation target, not a software vulnerability - Adobe — Document Cloud
Vulnerable versions: N/A - brand/environment impersonation target, not a software vulnerability - Generic — Corporate SSO / webmail login portals
Vulnerable versions: N/A - dynamically impersonated per-victim at request time - Various — Cryptocurrency exchange login portals
Vulnerable versions: N/A - brand/environment impersonation target, not a software vulnerability
Remediation for LogoKit Phishing-as-a-Service Evolves to Real-Time
Immediate actions
- Deploy phishing-resistant MFA (FIDO2 security keys, passkeys) so credential theft alone cannot be used to authenticate
- Enable conditional access / risk-based authentication requiring device trust and behavioral signals before honoring any login
- Block or sandbox links to free/ephemeral app-hosting platforms (e.g., glitch.me) at the secure email gateway and web proxy
Workarounds
- Treat unsolicited password/certificate-expiry or delivery-failure emails as high-risk and verify sender/provider reputation before entering any credentials
Longer-term hardening
- Deploy automated URL/link analysis to flag newly created, lookalike, and free-hosting-platform domains at click-time
- Implement browser isolation for links arriving from external or unverified senders
- Extend user awareness training to cover password/certificate-expiry, access-restriction, delivery-failure, timesheet, and ICANN-verification lure themes across all locales an organization operates in
Timeline of LogoKit Phishing-as-a-Service Evolves to Real-Time
- RiskIQ researchers first identify and publicly name 'LogoKit', an embeddable JavaScript phishing-kit family that dynamically fetches brand logos from Clearbit/Google Favicon and auto-fills the victim's harvested email into fake login forms.
- Original reporting documents LogoKit instances blocking browser keyboard shortcuts to hinder victim/analyst inspection of the fake page's source, exfiltrating typed credentials via an AJAX request to an attacker-controlled backend before redirecting victims to the real corporate site.
- Trade press (Dark Reading, BankInfoSecurity, IT Security Guru, Security Affairs) reports RiskIQ observed LogoKit active on 700+ unique domains within a 30-day window, hosted via compromised websites and abused legitimate cloud platforms (Firebase, GitHub Pages, Oracle Cloud), targeting SharePoint, Adobe Document Cloud, OneDrive, Office 365, and cryptocurrency-exchange logins.
- Abnormal AI (researchers Callie Baron and Piotr Wojtyla) publish research on 'Starkiller', a separate commercial phishing-as-a-service platform sold by the Jinkusu cybercrime group that proxies live copies of real login pages via headless-Chrome/Docker infrastructure to intercept credentials, session tokens, and MFA codes in real time; Infosecurity Magazine's later LogoKit coverage cites Abnormal's Starkiller findings as evidence of a broader industry-wide shift toward real-time, per-victim phishing pages that defeat static fingerprinting and domain blocklisting.
- SecurityBrief, iTWire, PNI News, and SMBTech republish and expand on the Barracuda findings, corroborating six-language lure deployment (English, German, French, Spanish, Chinese, Korean) and Barracuda's recommended defenses (phishing-resistant MFA, conditional access, browser isolation, automated URL analysis).
- Infosecurity Magazine publishes coverage of the Barracuda findings, confirming the victim-email-in-URL personalization mechanic and multi-language lure themes.
- The same research documents LogoKit's shift away from attacker-controlled C2 backends toward Telegram-bot-based credential exfiltration, removing a stable network indicator and letting operators run the scheme without dedicated backend infrastructure.
- Barracuda Networks (Sachin Meti, Threat Analysis Associate) publishes research documenting LogoKit's evolution from static 'brand impersonation' into real-time 'environment impersonation', pulling live Thum.io screenshots and Clearbit/Google Favicon/ImageKit/Microlink imagery of the victim's actual employer site to construct each phishing page dynamically per victim.
Sources cited for LogoKit Phishing-as-a-Service Evolves to Real-Time
- LogoKit Phishing Kit Screenshots Victim Sites in Real Time
- LogoKit phishing-as-a-service becomes a real-time deception platform
- LogoKit, a new phishing kit that dynamically creates phishing forms
- LogoKit Group Aims for Simple Yet Effective Phishing
- New toolkit can build phishing pages in real-time
- Phishing Kit Can Change Lures and Text
- Logokit phishing kit builds real-time fake login pages
- Logokit phishing kit evolves into a real-time, cloud-based deception platform
- Logokit phishing kit evolves into a real-time, cloud-based deception platform
- Logokit Phishing Kit Evolves Into Real-Time Platform That Clones Each Victim's Corporate Login Page
- Starkiller: New 'Commercial-Grade' Phishing Kit Bypasses MFA
- 'Starkiller' Phishing Service Proxies Real Login Pages, MFA
Detection coverage for TL-2026-1818
As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1818 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.