LogoKit Phishing-as-a-Service: Victim-Branded Credential Pages with Telegram Exfiltration

LogoKit is a phishing-as-a-service platform designed to generate tailored credential-harvesting pages for individual victims. Campaigns typically use phishing emails as the initial delivery vector, presenting routine administrative lures such as password expiry, access restriction, or email verification notices and directing recipients to a malicious link. When a recipient follows the link, JavaScript extracts their email address from the URL, isolates the domain associated with their organisation, and uses it to brand the credential-harvesting page.

At page load, LogoKit uses legitimate commercial APIs to retrieve branding assets and website imagery associated with the victim's organisation, creating a victim-specific imitation of its login environment rather than a generic phishing template. Credentials are exfiltrated directly from the victim's browser to a Telegram bot, without passing through an attacker-controlled server. The victim is then redirected to the legitimate website of the impersonated organisation, helping the interaction appear normal after credential submission.

Vega Threat Research developed a method for enumerating LogoKit infrastructure. While each victim receives a uniquely branded page, the underlying workflow used to produce it remains consistent. Across dynamically branded deployments, the same core sequence was observed: extract an email address from the URL, derive the organisation's domain, query third-party services for domain-specific branding, present a credential form, and exfiltrate submitted credentials through a separate channel such as Telegram. Vega pivoted on branding-service calls and credential-form behaviour exposed in client-side HTML and page-load requests, identifying deployments across multiple themes and hosting platforms. This approach targets functional characteristics of the kit rather than campaign-specific artefacts, enabling broader discovery across LogoKit variants without tying it to individual campaigns.

Vega queried public scanning and indexing services to identify candidate LogoKit pages, then validated them against the functional characteristics described above. This process identified 148 distinct hosts across a wide range of environments, including disposable hosting platforms, object storage, IPFS gateways, static-site and preview services, container platforms, and compromised legitimate websites. The analysis also recovered 117 distinct Telegram bot identifiers used for exfiltration, with limited reuse across hosts. This fragmentation suggests multiple independent users of a shared phishing service rather than a single operator, and makes exfiltration identifiers a useful clustering mechanism for separating individual LogoKit operations.