Logokit changes approach and focuses on real-time cloud-based security against phishing.
According to Barracuda, the Logokit phishing-as-a-service platform has evolved into a real-time, cloud-based system that dynamically mimics login pages for individual victims. Barracuda researchers demonstrate how attackers use legitimate web services to replicate the business environment of targets, making detection more difficult.
The Logokit platform is no longer limited to static phishing pages. Instead, it adjusts the content of fake login pages in real-time based on the victim’s email domain. This accurately copies the login experience of the target’s company, including logos, favicons, and screenshots of the legitimate website.
Dynamic attack method
When a victim clicks on a phishing link, the embedded code extracts the email address from the URL. The domain name is then used to identify the organization and generate a personalized phishing page. The stolen login credentials are sent to the attackers via Telegram, without traditional backend infrastructure.
The attacks are multilingual, with campaigns in English, German, French, Spanish, Chinese, and Korean. Nevertheless, classic social engineering tricks such as password expiration and account restrictions remain in use.
Defense against advanced phishing
Barracuda recommends a layered security approach, with automated threat detection and phishing-resistant multi-factor authentication such as FIDO2 security keys. Conditional access controls and opening suspicious links in isolated environments also help to mitigate risks.