A phishing-as-a-service (PaaS) platform has been observed building a unique login page for each victim in real time, pulling a live screenshot of the target organization’s own website to use as the page background.
According to new research from Barracuda published on July 29, recent LogoKit campaigns extracted the victim’s email address from the phishing URL, used the domain to identify their employer, then called commercial web services to assemble a matching page on the fly.
RiskIQ, which named the phishing kit in 2021, found it was already pulling brand logos from Clearbit and already carrying the victim’s email address in the URL.
What has changed is the live website screenshot, which Barracuda described as a shift from brand impersonation to environment impersonation, recreating parts of the victim’s genuine web environment rather than serving a generic replica.
Read more on phishing kit evasion: Starkiller New Commercial-Grade Phishing Kit Bypasses MFA
Legitimate Services Doing the Work
Barracuda found the kit using Thum.io, a commercial screenshot service, to capture the victim’s real website for the phishing background, and Clearbit to supply the matching brand logo.
Google Favicon, ImageKit and Microlink APIs loaded further authentic imagery as the page rendered.
Lures were routine, covering password and certificate expiry warnings, access restrictions, delivery failures, timesheet updates and ICANN verification notices.
Campaign emails appeared in English, German, French, Spanish, Chinese and Korean.
No Server, No Template, No Signature
Credential harvesting ran through a Telegram bot rather than an attacker-controlled backend. Victims were then redirected to the genuine site, where Barracuda suggested they would likely assume they had mistyped their password the first time.
Leaning on cloud services rather than owned infrastructure made campaigns easier to deploy, more resilient and harder for investigators to disrupt.
The per-victim approach also erodes conventional detection. Because each page is assembled at request time from live data, there is no static template for vendors to fingerprint and no stable indicator to blocklist, the same difficulty Abnormal researchers flagged with the Starkiller kit in February.
Barracuda urged organizations to deploy phishing-resistant multifactor authentication (MFA) such as FIDO2 keys and passkeys, which bind authentication to the legitimate domain so a fake page cannot present the correct cryptographic challenge.
It also recommended conditional access rules, browser isolation and URL filtering able to flag newly registered domains and links carrying an email address in the path.
