LogoKit Phishing Campaign Exploits Open Redirects to Steal Office 365 Credentials

A phishing campaign using the LogoKit kit abused open redirect vulnerabilities on trusted services, including Snapchat, to deliver credential-harvesting pages while evading spam filters and security checks. Resecurity said the activity targeted Office 365 users in the United States and Latin America, relying on trusted-looking redirect chains, compromised web resources, and hosting on platforms such as Fleek to make malicious links appear legitimate.

The kit dynamically customized phishing pages with victim-specific branding and prefilled email addresses, then exfiltrated credentials through AJAX before redirecting victims to legitimate corporate sites to reduce suspicion. Researchers linked the operation to infrastructure spread across hundreds of domains and impersonating brands including Bank of America, GoDaddy, Virgin Fly, Firebase, and Office 365, underscoring LogoKit's continued use as a long-running phishing platform.