Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

06:15 AM

LogoKit Group Aims for Simple Yet Effective Phishing

A phishing kit that uses embedded JavaScript targeted the users of more than 300 sites in the past week, aiming to grab credentials for SharePoint, Adobe Document Cloud, and OneDrive.

A relatively new phishing kit uses embedded JavaScript to dynamically change elements of spoofed webpages to more easily fool users.

The adoption of the phishing tool, called LogoKit, has seemingly accelerated, with 700 domains running the kit in the past month — 300 of those in only the last week — and targeting users of popular domains, such as Microsoft SharePoint and OneDrive, according to an analysis by cybersecurity firm RiskIQ. The attack tool is both simple and versatile, integrating with the presentation elements of a webpage and allowing it to change the look and feel of the website on the fly, the company said.

Related Content:

Web Application Attacks Double from 2019: Verizon DBIR

Special Report: 2021 Top Enterprise IT Trends

New From The Edge: Learn SAML: The Language You Don't Know You're Already Speaking

In addition, its strategy of using legitimate services to host site elements makes the phishing sites harder to detect, says Adam Castleman, threat researcher at RiskIQ.

"Its flexibility in being able to be adapted into multiple social engineering pretexts in only a few lines of JavaScript and HTML is what makes this interesting," he says. "Attackers can host their collection script for stealing credentials on any third-party server while hiding one or multiple pretexts on legitimate or compromised Web services."

Phishing continues to be one of the most used tactics among attackers to kick off an attack, second only to the use of stolen credentials. Attackers used phishing in 22% of successful breaches and used or stole credentials in 37% of successful breaches, according to the annual Verizon Data Breach Report (DBIR)

"Phishing has been — and still remains — a fruitful method for attackers," the DBIR states. "The good news is that click rates are as low as they ever have been — 3.4% — and reporting rates are rising, albeit slowly." 

Google's Threat Analysis Group announced this week that North Korean hackers had used social engineering to fool some security researchers into connecting on social media and, in some cases, downloading malware.

As a simple and flexible toolkit with templates for major online services, LogoKit could make a larger number of users vulnerable to phishing attacks, especially with the toolkit's ability to use different delivery methods, such as compromised sites, attacker-hosted infrastructure, and object storage, RiskIQ states in its report.

The toolkit is not technically sophisticated but is well-thought-out, says Castleman.

"While not overly complex, one of the more interesting facets of LogoKit is the use of legitimate object hosting providers, such as Amazon S3, in an attempt to bypass common email and network filtering," he says.

RiskIQ has found examples of the toolkit targeting — among other services — SharePoint, Adobe Document Cloud, OneDrive, Office 365, Google Firebase portals, Amazon object storage, and Digital Ocean object storage. The use of legitimate services may make phishing pages harder to spot, RiskIQ says. 

If a victim enters his credentials into the displayed login page, LogoKit will send the information to an attacker-controlled server and then redirect the user to the legitimate site, which LogoKit has mimicked. In some cases, the attacker may require the user to re-enter their password — perhaps as a check that the password is correct. 

LogoKit is not the only phishing campaign to use JavaScript in creative ways. In October, Akamai found that a larger volume of phishing attacks used JavaScript as a way to obfuscate the intent of any files or scripts in the e-mail.

Companies should focus on security-awareness training for employees because the URLs generated by LogoKit use legitimate services and could easily bypass existing security measures. RiskIQ recommends that site administrators regularly review their content management systems for updates to catch any changes made by the phishing toolkit as well as look for injected code.

"Companies should ensure that users are aware of common phishing tactics and to always verify communications regarding their accounts with corporate IT departments," Castleman says. "As LogoKit users can send links to commonly used services, this increases the potential success of bypassing spam filters."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key va...
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to...
PUBLISHED: 2021-02-26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>.
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default beh...
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via th...