Loading story…
Barracuda researchers reported that the LogoKit phishing-as-a-service platform has evolved into a real-time deception system that builds a unique login page for each target. The kit extracts the victim’s email address from the URL, identifies the employer’s domain, and assembles branded content on demand, including a live screenshot of the organization’s legitimate website as the page background. Researchers said the shift moves phishing beyond simple brand spoofing toward environment impersonation, while the victim is often redirected to the real site after submitting credentials, reducing suspicion.
The campaigns were observed in multiple languages, including English, German, French, Spanish, Chinese, and Korean, and rely heavily on legitimate cloud services such as Thum.io, Clearbit, Google Favicon, ImageKit, and Microlink. Stolen credentials are exfiltrated through Telegram bots rather than attacker-hosted infrastructure, making the operation easier to deploy and harder to disrupt or detect with traditional indicator- and template-based defenses. Barracuda recommended phishing-resistant MFA such as FIDO2 security keys and passkeys, along with conditional access, browser isolation, provider and brand impersonation checks, and URL filtering for newly registered domains and links containing email addresses in the path.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Barracuda reported that recent LogoKit campaigns generated a unique phishing login page for each victim in real time by extracting the victim's email address, identifying the employer's domain, and assembling branded content dynamically. The research also found the kit using live screenshots of legitimate sites as backgrounds, relying on services such as Thum.io, Clearbit, Google Favicon, ImageKit, and Microlink, and exfiltrating credentials via Telegram bots before redirecting victims to the real website.
RiskIQ identified and named the phishing kit LogoKit. Its earlier analysis found the kit pulled brand logos from Clearbit and carried the victim's email address in the phishing URL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourceblog.barracuda.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign using the **LogoKit** kit abused open redirect vulnerabilities on trusted services, including Snapchat, to deliver credential-harvesting pages while evading spam filters and security checks. Resecurity said the activity targeted **Office 365** users in the United States and Latin America, relying on trusted-looking redirect chains, compromised web resources, and hosting on platforms such as **Fleek** to make malicious links appear legitimate. The kit dynamically customized phishing pages with victim-specific branding and prefilled email addresses, then exfiltrated credentials through AJAX before redirecting victims to legitimate corporate sites to reduce suspicion. Researchers linked the operation to infrastructure spread across hundreds of domains and impersonating brands including **Bank of America**, **GoDaddy**, **Virgin Fly**, **Firebase**, and **Office 365**, underscoring LogoKit's continued use as a long-running phishing platform.
Aug 14, 2026
Researchers at Varonis Threat Labs identified **Bluekit**, a phishing-as-a-service kit that packages domain registration, phishing page deployment, campaign management, credential handling, and real-time victim session monitoring into a single dashboard. The platform ships with more than 40 templates impersonating major brands and services including Apple, Gmail, Outlook, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger, and it supports Telegram-based exfiltration of stolen data. Investigators said the kit is under active development and is designed to lower the barrier for less experienced cybercriminals. Bluekit also advertises an **AI Assistant** that can help generate phishing campaign drafts and lists multiple model options, including `Llama`, `GPT-4.1`, `Claude`, `Gemini`, and `DeepSeek`. Testing found the feature remains immature: only the default Llama option worked without added configuration, and its output relied on placeholders rather than producing polished, ready-to-launch lures. Even so, researchers said Bluekit includes advanced evasion and attack features such as VPN and proxy blocking, headless-browser detection, fingerprint and device filtering, geolocation tricks, spoofing, voice cloning, antibot cloaking, and claimed support for bypassing two-factor authentication, raising concern that continued development could accelerate adoption in phishing campaigns.
Jun 29, 2026
The **Bluekit** phishing-as-a-service platform has expanded quickly and upgraded its credential-theft capability by shifting from adversary-in-the-middle methods to **browser-in-the-middle** attacks aimed at Microsoft logins. Netcraft identified nearly **70 live hostnames** in a week and reported that Bluekit streams an attacker-controlled browser session to victims using the legitimate `rrweb` JavaScript library over WebSockets, letting targets interact with the real Microsoft sign-in page while attackers capture credentials and authenticated session tokens in real time. Researchers said the approach can **bypass MFA** because authentication is completed inside the attacker’s browser, eliminating the browser-fingerprint mismatch often associated with reverse-proxy phishing kits such as Evilginx. Bluekit also includes anti-analysis and victim-filtering features including obfuscated JavaScript, randomized CSS filters, browser fingerprinting, WebRTC-based IP mismatch checks, fake brand-themed CAPTCHA pages, live victim monitoring, AI-assisted phishing email generation, and templates targeting major online services.
Sep 4, 2026