LogoKit update – The phishing kit leveraging Open Redirect Vulnerabilities

MITRE Techniques

• [T1566.002] Phishing: Spearphishing Link – The embedded link uses Open Redirect Vulnerability to direct victims to a phishing resource. Quote: “The embedded link is leveraging Open Redirect Vulnerability in Snapchat, and another URL from Google leading to a phishing resource:”
• [T1566.003] Phishing: Spearphishing via Service – Impersonation of trusted services (e.g., Snapchat, online services) to host phishing resources. Quote: “Using highly trusted service domains like Snapchat and other online-services, they create special URLs which lead to malicious resources with phishing kits.”
• [T1036] Masquerading – Activity is hidden behind legitimate service notifications to evade detection. Quote: “these tactics allow cybercriminals to masquerade their activity behind the notifications of legitimate services to evade detection.”
• [T1027] Obfuscated/Compressed Files and Information – LogoKit content is obfuscated on landing pages. Quote: “The content of the pages generated by LogoKit is typically obfuscated.”
• [T1056.003] Credentials in Web Forms – Victims’ emails auto-filled and passwords captured via AJAX to an external source. Quote: “The victim’s email is then auto filled in the email or username field … Should the victim then enter their password, LogoKit performs an AJAX request, sending the target’s email and password to an external source.”
• [T1041] Exfiltration Over C2 Channel – Credentials exfiltration to an external server via AJAX before redirection. Quote: “…sending the target’s email and password to an external source, then finally redirecting the victim to their ‘legitimate’ corporate website.”