LogoKit Group Aims for Simple Yet Effective Phishing

A relatively new phishing kit uses embedded JavaScript to dynamically change elements of spoofed webpages to more easily fool users.

The adoption of the phishing tool, called LogoKit, has seemingly accelerated, with 700 domains running the kit in the past month — 300 of those in only the last week — and targeting users of popular domains, such as Microsoft SharePoint and OneDrive, according to an analysis by cybersecurity firm RiskIQ. The attack tool is both simple and versatile, integrating with the presentation elements of a webpage and allowing it to change the look and feel of the website on the fly, the company said.

In addition, its strategy of using legitimate services to host site elements makes the phishing sites harder to detect, says Adam Castleman, threat researcher at RiskIQ.

"Its flexibility in being able to be adapted into multiple social engineering pretexts in only a few lines of JavaScript and HTML is what makes this interesting," he says. "Attackers can host their collection script for stealing credentials on any third-party server while hiding one or multiple pretexts on legitimate or compromised Web services."

Phishing continues to be one of the most used tactics among attackers to kick off an attack, second only to the use of stolen credentials. Attackers used phishing in 22% of successful breaches and used or stole credentials in 37% of successful breaches, according to the annual Verizon Data Breach Report (DBIR). 

"Phishing has been — and still remains — a fruitful method for attackers," the DBIR states. "The good news is that click rates are as low as they ever have been — 3.4% — and reporting rates are rising, albeit slowly." 

Google's Threat Analysis Group announced this week that North Korean hackers had used social engineering to fool some security researchers into connecting on social media and, in some cases, downloading malware.

As a simple and flexible toolkit with templates for major online services, LogoKit could make a larger number of users vulnerable to phishing attacks, especially with the toolkit's ability to use different delivery methods, such as compromised sites, attacker-hosted infrastructure, and object storage, RiskIQ states in its report.

The toolkit is not technically sophisticated but is well-thought-out, says Castleman.

"While not overly complex, one of the more interesting facets of LogoKit is the use of legitimate object hosting providers, such as Amazon S3, in an attempt to bypass common email and network filtering," he says.

RiskIQ has found examples of the toolkit targeting — among other services — SharePoint, Adobe Document Cloud, OneDrive, Office 365, Google Firebase portals, Amazon object storage, and Digital Ocean object storage. The use of legitimate services may make phishing pages harder to spot, RiskIQ says. 

If a victim enters his credentials into the displayed login page, LogoKit will send the information to an attacker-controlled server and then redirect the user to the legitimate site, which LogoKit has mimicked. In some cases, the attacker may require the user to re-enter their password — perhaps as a check that the password is correct. 

LogoKit is not the only phishing campaign to use JavaScript in creative ways. In October, Akamai found that a larger volume of phishing attacks used JavaScript as a way to obfuscate the intent of any files or scripts in the e-mail.

Companies should focus on security-awareness training for employees because the URLs generated by LogoKit use legitimate services and could easily bypass existing security measures. RiskIQ recommends that site administrators regularly review their content management systems for updates to catch any changes made by the phishing toolkit as well as look for injected code.

"Companies should ensure that users are aware of common phishing tactics and to always verify communications regarding their accounts with corporate IT departments," Castleman says. "As LogoKit users can send links to commonly used services, this increases the potential success of bypassing spam filters."