# LogoKit Phishing-as-a-Service Evolves to Real-Time "Environment Impersonation"

> Barracuda Networks research (published 2026-07-29, author Sachin Meti) documents LogoKit — a phishing-as-a-service kit first named by RiskIQ in January 2021 — evolving from static brand impersonation into real-time "environment impersonation": it extracts the victim's email and employer domain from the phishing URL, pulls live website screenshots (Thum.io) and brand assets (Clearbit, Google Favicon, ImageKit, Microlink) to recreate the victim's actual corporate login page per-request, then exfiltrates harvested credentials to a Telegram bot and redirects the victim to the genuine site.

- **Published:** 2026-08-02T00:00:00Z
- **Last reviewed:** 2026-08-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1818
- **ID:** TL-2026-1818
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LogoKit is an embeddable, lightweight JavaScript phishing-kit family first identified and named by RiskIQ in January 2021, when researchers observed it running on more than 700 unique domains within a single 30-day window. The original kit worked by embedding the victim's email address in the phishing URL (typically in the location hash), fetching the target organization's logo from a third-party brand API (Clearbit or Google's favicon service), auto-filling the victim's email into the fake login form to build false familiarity, and exfiltrating any entered credentials via an AJAX request to an attacker-controlled or third-party endpoint before redirecting the victim to the real corporate site. It was distributed across a mix of compromised websites and abused legitimate cloud platforms (Firebase, GitHub Pages, Oracle Cloud), primarily impersonating Microsoft SharePoint, Adobe Document Cloud, OneDrive, and Office 365 login pages, as well as cryptocurrency-exchange portals. Some instances blocked browser keyboard shortcuts to hinder victims or analysts from inspecting page source.

Barracuda's July 2026 research documents a significant evolution of the same kit family: a shift from static "brand impersonation" (a fixed logo pasted onto a generic template) to dynamic "environment impersonation," where each phishing page is assembled at request time to closely mirror the victim's actual, real corporate web environment. The kit still extracts the victim's email address from the phishing URL and derives the employer's domain from it, but now uses that domain to drive a chain of legitimate third-party API calls: Thum.io generates a live, full-page screenshot of the victim's genuine corporate website to use as the phishing page's background; Clearbit supplies the matching brand logo; Google's favicon service and ImageKit load authentic supplementary imagery; and Microlink APIs pull additional real-time website content. Because every element of the page is fetched live and per-victim rather than baked into a static template, there is no fixed artifact for security vendors to fingerprint or blocklist, which materially raises the detection-evasion bar compared to the original 2021 kit.

The second major change is in the exfiltration path: rather than POSTing stolen credentials to an attacker-controlled backend server (the original kit's design, and a stable network indicator defenders could hunt and block), the 2026 variant routes harvested credentials through a Telegram bot. This removes the need for the operator to stand up or maintain dedicated C2 infrastructure and further reduces the forensic footprint, since Telegram Bot API traffic blends in with a huge volume of legitimate application traffic. As before, victims are redirected to the real target site immediately after submitting credentials, reinforcing the illusion that they simply mistyped their password rather than been phished. Barracuda's campaign sample included lures for password/certificate expiry, access restriction notices, delivery failures, timesheet updates, and ICANN verification notices, localized across English, German, French, Spanish, Chinese, and Korean, indicating a broad, internationally-targeted operation rather than a narrow regional campaign. No specific threat-actor group, nation-state sponsor, or CVE is associated with this report; LogoKit is sold/operated as a commodity phishing-as-a-service tool rather than being tied to a single named intrusion set, and industry coverage has informally referred to its operators as "the LogoKit group" without formal attribution.

From a defensive standpoint, Barracuda recommends phishing-resistant MFA (FIDO2 security keys, passkeys) as the most durable mitigation, since it neutralizes credential-only theft regardless of how convincing the impersonation is; conditional/risk-based access policies that weigh device trust and behavioral signals before honoring a login; browser isolation for links arriving from unverified senders; and automated URL/link analysis capable of flagging newly created domains and free/ephemeral app-hosting platforms (such as the glitch.me subdomain observed hosting a live LogoKit instance) at click time.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1590.001 Domain Properties
- T1598.003 Spearphishing Link
- T1583.006 Web Services
- T1584.001 Domains
- T1585.001 Social Media Accounts
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1204.001 Malicious Link
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [LogoKit Phishing Kit Screenshots Victim Sites in Real Time](https://www.infosecurity-magazine.com/news/logokit-phishing-real-time/)
- [LogoKit phishing-as-a-service becomes a real-time deception platform](https://blog.barracuda.com/2026/07/29/logokit-phishing-service-real-time-deception-platform)
- [LogoKit, a new phishing kit that dynamically creates phishing forms](https://securityaffairs.com/113961/cyber-crime/logokit-phishing-kit.html)
- [LogoKit Group Aims for Simple Yet Effective Phishing](https://www.darkreading.com/vulnerabilities-threats/logokit-group-aims-for-simple-yet-effective-phishing)
- [New toolkit can build phishing pages in real-time](https://www.itsecurityguru.org/2021/01/28/new-toolkit-can-build-phishing-pages-in-real-time/)
- [Phishing Kit Can Change Lures and Text](https://www.bankinfosecurity.com/phishing-kit-change-lures-text-a-15892)
- [Logokit phishing kit builds real-time fake login pages](https://securitybrief.com.au/story/logokit-phishing-kit-builds-real-time-fake-login-pages)
- [Logokit phishing kit evolves into a real-time, cloud-based deception platform](https://itwire.com/business-it-news/security/logokit-phishing-kit-evolves-into-a-real-time-cloud-based-deception-platform)
- [Logokit phishing kit evolves into a real-time, cloud-based deception platform](https://www.pninews.com/logokit-phishing-kit-evolves-into-a-real-time-cloud-based-deception-platform/)
- [Logokit Phishing Kit Evolves Into Real-Time Platform That Clones Each Victim's Corporate Login Page](https://smbtech.au/news/logokit-phishing-kit-evolves-into-real-time-platform-that-clones-each-victims-corporate-login-page/)
- [Starkiller: New 'Commercial-Grade' Phishing Kit Bypasses MFA](https://www.infosecurity-magazine.com/news/starkiller-phishing-kit-bypasses/)
- ['Starkiller' Phishing Service Proxies Real Login Pages, MFA](https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1818