LogoKit: Analysis of dynamic phishing kit targeting Microsoft customers

The phishing kit targeting Microsoft customers, LogoKit, has recently been highlighted within several articles citing it’s capability to dynamically load in company logos depending on the email address provided by the potential victim. This technique is especially effective in getting victims to trust the legitimacy of the web page as this event is also present on Office 365’s own login workflow.

This technique of dynamically loading in assets however is not recent, and the code within LogoKit has been altered, reused and integrated within similar phishing kits since at least early 2020.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

LogoKit refers to a type of phishing kit currently being used in a very active phishing campaign targeting Office 365 users. It utilises JavaScript within it’s source files to pull in company logos from clearbit[.]com based on the email address provided. Clearbit is a marketing firm which also provides a free service and API endpoint to retrieve logos for many companies across the globe. The default landing page is a copy of an older version of Microsoft’s Office 365 login portal.

Figure 1: LogoKit phishing page (left), Legitimate Microsoft login page (right)

When an email address is populated within the login form, or appended to the phishing pages URL an AJAX call is made to clearbit[.]com to pull in a logo associated with the email addresses domain.

Figure 2: Logo populated based on provided email address domain

Figure 3: AJAX code calling logo.clearbit[.]com for the email address domain

Upon entering an email address and password, the information is submitted to a dropper email address configured by the threat actor deploying the kit. The victim is prompted for their password twice before the site then redirects them to a concatenation of www. + email address domain.

Figure 4: JavaScript code responsible for redirecting the victim at the end of the phishing workflow

ZeroFOX Alpha Team have analysed multiple variants of this kit, with most of the source code remaining intact between versions, including spelling errors. The main difference found within these kits is the wording of emails sent to the threat actors dropper mailbox, where various threat actors have updated the “created by” line within the template.

Figure 5: Aliases claiming ownership of creation differ between copies of the kit

The primary TTP of note for this kit however is not a new concept. Phishing kits utilising clearbit to retrieve brand logos based on input is present within hundreds of separate families of kits, with targets ranging from retail and banking, to document sharing platforms and technology companies.

Figure 6: Source code of other kits utilising similar functionality

During tracking of this campaign ZeroFOX Alpha Team obtained several copies of LogoKit which contained a hidden .git directory. Git is a distributed version-control system for tracking changes in files, and is used with providers such as Github to host and manage project source code. Within this directory there are multiple files containing compressed copies of files, metadata and other artifacts. The compressed source code, once expanded, contains PHP code designed to phish for Sharepoint online and Office 365 credentials, similar to LogoKit. Comparing the source code to that within LogoKit shows the JavaScript code has likely originated from this original project.

Figure 7: Original code within .git directory (left), LogoKit source code (right)

Additional data included within the hidden directory provides information about the original repository for the project including the author and email address associated with the Github account. Timestamps also indicate this project was originally created on Thursday, 16 January 2020.

Figure 8: Repo and commit history exposing the account name and email address of the owner

Conclusion

Phishing is a serious threat and phishing kit operators and authors are consistently changing tactics to steal sensitive financial and personal information from unsuspecting victims. Due to the lack of any form of obfuscation, DRM or controls within LogoKit’s source code Alpha Team assesses with HIGH likelihood that the kit will continue to be altered and redistributed over time. ZeroFOX advises implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of cyberattacks.

Indicators

[email protected]
[email protected],
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

1d4cff66d95060a01ee2a7dc659018163085a992e8609e37d5a906d72b66411d
4ac7c82865cf478c2e1a19f97b3a011d5699fa9657d1323eac4417d7c3cfafbc
6bc6e1a35fe651adcd99c693c2eb20011518857691e9f4b51023e581a9c51810
6d1f3f87a2013fe5c8d7090a7250d6bf031e364b7fcd47fd119872dfc9630f31
875d805c9fabc210f3aa5757491c1bae0eba690a328e9c0ddcf7626fa3053c71
9e2dafc31bcd2c4ec74b240b02dc4d5f6af66b5dee850f8882b351f7119c816f
a9735703836fd821b2984324a28be4a4311407b33f81ea6638d124e67900b441
e6134584b5140e10d6fde2f23901bcc0ff3f54adeaca2f68c91dc313f753ca7f
e6567c475b4ca98a5310cb1b07ca854511919a8347d10ba4848a02b86fdf1e58