LogoKit Phishing Kit Uses Real-Time Site Screenshots and Telegram Exfiltration

Barracuda researchers reported that the LogoKit phishing-as-a-service platform has evolved into a real-time deception system that builds a unique login page for each target. The kit extracts the victim’s email address from the URL, identifies the employer’s domain, and assembles branded content on demand, including a live screenshot of the organization’s legitimate website as the page background. Researchers said the shift moves phishing beyond simple brand spoofing toward environment impersonation, while the victim is often redirected to the real site after submitting credentials, reducing suspicion.

The campaigns were observed in multiple languages, including English, German, French, Spanish, Chinese, and Korean, and rely heavily on legitimate cloud services such as Thum.io, Clearbit, Google Favicon, ImageKit, and Microlink. Stolen credentials are exfiltrated through Telegram bots rather than attacker-hosted infrastructure, making the operation easier to deploy and harder to disrupt or detect with traditional indicator- and template-based defenses. Barracuda recommended phishing-resistant MFA such as FIDO2 security keys and passkeys, along with conditional access, browser isolation, provider and brand impersonation checks, and URL filtering for newly registered domains and links containing email addresses in the path.