Loading story…
A phishing campaign using the LogoKit kit abused open redirect vulnerabilities on trusted services, including Snapchat, to deliver credential-harvesting pages while evading spam filters and security checks. Resecurity said the activity targeted Office 365 users in the United States and Latin America, relying on trusted-looking redirect chains, compromised web resources, and hosting on platforms such as Fleek to make malicious links appear legitimate.
The kit dynamically customized phishing pages with victim-specific branding and prefilled email addresses, then exfiltrated credentials through AJAX before redirecting victims to legitimate corporate sites to reduce suspicion. Researchers linked the operation to infrastructure spread across hundreds of domains and impersonating brands including Bank of America, GoDaddy, Virgin Fly, Firebase, and Office 365, underscoring LogoKit's continued use as a long-running phishing platform.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Around November 2021, more than 700 domains were identified in campaigns leveraging LogoKit. The report describes the number of domains used by LogoKit campaigns as continuously growing.
The report states that the LogoKit phishing kit has existed in underground use since at least 2015. This establishes the earliest known activity for the kit referenced in the campaign analysis.
Over the past week, Resecurity identified LogoKit on more than 300 domains, and over the past month on more than 700 sites. The infrastructure included domains impersonating brands such as Bank of America, GoDaddy, Virgin Fly, Firebase, and Office 365.
Resecurity observed a spike in LogoKit activity around the beginning of August. The increase coincided with the registration of multiple new domains impersonating popular services.
Resecurity described a phishing campaign identified on July 13 targeting Office 365 users in the United States and Latin America. The campaign used open redirect vulnerabilities, including one on Snapchat, to route victims to credential-harvesting pages.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Barracuda researchers reported that the **LogoKit** phishing-as-a-service platform has evolved into a real-time deception system that builds a unique login page for each target. The kit extracts the victim’s email address from the URL, identifies the employer’s domain, and assembles branded content on demand, including a live screenshot of the organization’s legitimate website as the page background. Researchers said the shift moves phishing beyond simple brand spoofing toward **environment impersonation**, while the victim is often redirected to the real site after submitting credentials, reducing suspicion. The campaigns were observed in multiple languages, including English, German, French, Spanish, Chinese, and Korean, and rely heavily on legitimate cloud services such as **Thum.io, Clearbit, Google Favicon, ImageKit, and Microlink**. Stolen credentials are exfiltrated through **Telegram bots** rather than attacker-hosted infrastructure, making the operation easier to deploy and harder to disrupt or detect with traditional indicator- and template-based defenses. Barracuda recommended **phishing-resistant MFA** such as **FIDO2** security keys and passkeys, along with conditional access, browser isolation, provider and brand impersonation checks, and URL filtering for newly registered domains and links containing email addresses in the path.
Aug 11, 2026
Attackers ran a credential-theft campaign that impersonated **Office 365** password-expiration notices to target CEOs and other senior executives across manufacturing, real estate, finance, government, and technology organizations. The operation used more than **300 compromised URLs** and reused hijacked infrastructure and stolen credentials to reach victims in the United States, Japan, the UK, Canada, Australia, and parts of Europe, with lures tailored to high-value corporate personnel. Researchers found the campaign relied on a commercially sold **Office 365 phishing kit** identified as **version 4**, which included credential validation, anti-analysis blocklists, bot detection, and license-verification features. Misconfigured phishing pages exposed kit files and logs containing stolen victim data and redirection details, while test traffic linked to IP addresses in **Morocco** offered possible attribution clues; the emails were commonly sent through **FireVPS RDP** infrastructure, and underground forum activity showed active sales of both the phishing kit and compromised executive account credentials.
Aug 14, 2026
Attackers ran an **Office 365 credential-harvesting campaign** that sent "missed voice message" lures through legitimate University of Oxford SMTP servers, helping the emails bypass trust-based defenses and appear credible to recipients. The operation primarily targeted organizations in Europe, with additional activity observed in Asia and the Middle East, and focused on stealing Microsoft 365 credentials through convincing fake login pages. The attack chain used multiple trusted and compromised services to evade detection, including Samsung Canada’s Adobe Campaign **open redirect** capability and compromised WordPress sites that forwarded victims to obfuscated phishing pages. Researchers said the operators continuously rotated redirect infrastructure, created per-victim directories, and used JavaScript-generated, XOR-obfuscated HTML to make the phishing kit harder to detect and analyze; Adobe and Samsung were reported as abused infrastructure providers rather than victims of a software exploit.
Aug 14, 2026