Full Report
Learn how Group-IB’s Business Email Protection stops the growing wave of DocuSign impersonation before users are exposed, and protects them from credential-capturing websites built with real-time customizable LogoKit.
Analysis Summary
# Tool/Technique: LogoKit (Real-time Phishing Kit)
## Overview
LogoKit is a sophisticated, modular phishing framework designed to create real-time, customizable credential-harvesting websites. It dynamically adapts its appearance based on the victim's email address, automatically fetching company logos and branding to increase the perceived legitimacy of the fraudulent page. In recent campaigns, it has been paired with DocuSign impersonation to bypass traditional email security filters.
## Technical Details
- **Type:** Phishing Tool / Credential Harvester Framework
- **Platform:** Web-based (Targeting any OS with a browser)
- **Capabilities:** Real-time branding injection, dynamic content morphing, credential exfiltration.
- **First Seen:** Approximately 2020 (active waves continuing through 2024).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1556 - Modify Authentication Process]
- **[TA0007 - Discovery]**
- [T1589.002 - Gather Victim Identity Information: Email Addresses]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Dynamic Branding:** The kit uses JavaScript to extract the domain from the victim's email address (e.g., [email protected]) and automatically fetches the official company logo (often via third-party APIs like Clearbit or Google Favicons) to populate the phishing page.
- **Credential Harvesting:** Captures usernames, passwords, and potentially MFA tokens, sending them to attacker-controlled backends.
- **URL Parameter Utilization:** Often uses the victim’s email address appended to the URL (e.g., `[email protected]`) to pre-fill login forms.
### Advanced Features
- **Evasion via Decentralized Infrastructure:** Links often point to pages hosted on IPFS (InterPlanetary File System) or AWS S3 buckets to leverage high-reputation domains and evade static blocklists.
- **Real-time Morphing:** The page does not exist in its final "malicious" state until the JavaScript executes in the victim's browser, making server-side scanning difficult.
- **Header Mismatching:** Used in conjunction with spoofing techniques where "Reply-To" and "From" headers are mismatched to deceive both users and basic filters.
## Indicators of Compromise
- **File Names:** `login.html`, `index.js` (common in kits, though often obscured).
- **Network Indicators:**
- `ipfs[.]io/ipfs/[unique_hash]`
- `s3[.]amazonaws[.]com/[bucket_name]`
- `docusign[.]com[.]rest-api[.]support` (example of look-alike domain)
- **Behavioral Indicators:**
- Presence of JavaScript that parses URL parameters for email patterns.
- Unexpected outbound calls to logo-fetching APIs (e.g., Clearbit) from a login page.
- SPF/DKIM failures combined with "DocuSign" branding.
## Associated Threat Actors
- While used by various cybercriminal groups, it is commonly associated with **Commodity Phishing Actors** and **Business Email Compromise (BEC)** specialists.
## Detection Methods
- **Behavioral Detection:** Identifying the dynamic loading of third-party logos based on URL parameters.
- **Time-of-Click (ToC) Analysis:** Evaluating the page in its live state at the moment the user clicks, rather than just at the time of email delivery.
- **Linguistic Analysis:** ML-based detection of spam-like features and personalized subject lines (e.g., including the recipient's login name).
- **Infrastructure Correlation:** Detecting failed SPF/DKIM signatures paired with impersonated brand headers.
## Mitigation Strategies
- **Multi-Factor Authentication (MFA):** Implementing FIDO2/WebAuthn-based MFA to prevent credential reuse.
- **Time-of-Click Protection:** Deploying email security solutions that re-evaluate links upon user interaction.
- **Content Disarm and Reconstruction (CDR):** Neutralizing active content in emails before they reach the inbox.
- **User Awareness Training:** Educating users to verify the source of DocuSign requests, especially if the URL contains their email address as a parameter.
## Related Tools/Techniques
- **EvilProxy / Nex-Proxy:** For AitM (Adversary-in-the-Middle) phishing.
- **Decentralized Hosting:** Using IPFS or Telegram bots for backend exfiltration.
- **Homograph Attacks:** Using look-alike domains to host the LogoKit framework.