Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

06:15 AM

LogoKit Group Aims for Simple Yet Effective Phishing

A phishing kit that uses embedded JavaScript targeted the users of more than 300 sites in the past week, aiming to grab credentials for SharePoint, Adobe Document Cloud, and OneDrive.

A relatively new phishing kit uses embedded JavaScript to dynamically change elements of spoofed webpages to more easily fool users.

The adoption of the phishing tool, called LogoKit, has seemingly accelerated, with 700 domains running the kit in the past month — 300 of those in only the last week — and targeting users of popular domains, such as Microsoft SharePoint and OneDrive, according to an analysis by cybersecurity firm RiskIQ. The attack tool is both simple and versatile, integrating with the presentation elements of a webpage and allowing it to change the look and feel of the website on the fly, the company said.

Related Content:

Web Application Attacks Double from 2019: Verizon DBIR

Special Report: 2021 Top Enterprise IT Trends

New From The Edge: Learn SAML: The Language You Don't Know You're Already Speaking

In addition, its strategy of using legitimate services to host site elements makes the phishing sites harder to detect, says Adam Castleman, threat researcher at RiskIQ.

"Its flexibility in being able to be adapted into multiple social engineering pretexts in only a few lines of JavaScript and HTML is what makes this interesting," he says. "Attackers can host their collection script for stealing credentials on any third-party server while hiding one or multiple pretexts on legitimate or compromised Web services."

Phishing continues to be one of the most used tactics among attackers to kick off an attack, second only to the use of stolen credentials. Attackers used phishing in 22% of successful breaches and used or stole credentials in 37% of successful breaches, according to the annual Verizon Data Breach Report (DBIR)

"Phishing has been — and still remains — a fruitful method for attackers," the DBIR states. "The good news is that click rates are as low as they ever have been — 3.4% — and reporting rates are rising, albeit slowly." 

Google's Threat Analysis Group announced this week that North Korean hackers had used social engineering to fool some security researchers into connecting on social media and, in some cases, downloading malware.

As a simple and flexible toolkit with templates for major online services, LogoKit could make a larger number of users vulnerable to phishing attacks, especially with the toolkit's ability to use different delivery methods, such as compromised sites, attacker-hosted infrastructure, and object storage, RiskIQ states in its report.

The toolkit is not technically sophisticated but is well-thought-out, says Castleman.

"While not overly complex, one of the more interesting facets of LogoKit is the use of legitimate object hosting providers, such as Amazon S3, in an attempt to bypass common email and network filtering," he says.

RiskIQ has found examples of the toolkit targeting — among other services — SharePoint, Adobe Document Cloud, OneDrive, Office 365, Google Firebase portals, Amazon object storage, and Digital Ocean object storage. The use of legitimate services may make phishing pages harder to spot, RiskIQ says. 

If a victim enters his credentials into the displayed login page, LogoKit will send the information to an attacker-controlled server and then redirect the user to the legitimate site, which LogoKit has mimicked. In some cases, the attacker may require the user to re-enter their password — perhaps as a check that the password is correct. 

LogoKit is not the only phishing campaign to use JavaScript in creative ways. In October, Akamai found that a larger volume of phishing attacks used JavaScript as a way to obfuscate the intent of any files or scripts in the e-mail.

Companies should focus on security-awareness training for employees because the URLs generated by LogoKit use legitimate services and could easily bypass existing security measures. RiskIQ recommends that site administrators regularly review their content management systems for updates to catch any changes made by the phishing toolkit as well as look for injected code.

"Companies should ensure that users are aware of common phishing tactics and to always verify communications regarding their accounts with corporate IT departments," Castleman says. "As LogoKit users can send links to commonly used services, this increases the potential success of bypassing spam filters."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.