Legokit phishing kit
Legokit is our name for the kit publicly called LogoKit, which builds a branded login from the email address in its link. We have matched it on 286 sites since 10 August.
Legokit in numbers
Since 10 August, the first Legokit match in our records, counted on 12 October 2026. How we count.
| Sites with Legokit code | 286 |
|---|---|
| Sites with a match in the last 30 days | 190 |
| New sites in September | 200 |
| Sites captured since 25 September | 89 |
RiskIQ named the kit LogoKit
RiskIQ named LogoKit in public research reported by Security Affairs. The original design put an email address in the link, used its domain to add company branding and redirected the visitor to that domain after collection. Our repository uses Legokit as the family name.
Barracuda's later analysis documents the same link-driven branding in current pages, including screenshots and favicons loaded from public services.
The email address assembles the lure
The address arrives in the URL fragment or a query parameter. JavaScript extracts its domain, prefills a read-only email field and requests matching visual material. Captured pages use a Google favicon and a Thum.io screenshot of the domain as a blurred background. Other copies use Clearbit, ImageKit or Microlink for the same job.
The visible themes include webmail, Microsoft 365, cPanel, Fortinet, delivery notices and file-sharing prompts. The script can build all of them from one template because the address, logo and background arrive at run time.
Each error asks for another password
The visitor supplies only a password. An early submission returns to the form with an invalid-password message. Captured builds require between two and five attempts before sending the browser to the legitimate domain derived from the address.
One four-attempt copy posts the email, password, IP address, location, browser details, attempt number and time directly to the Telegram Bot API. Other variants use local PHP files such as next.php or src.php, an Axios endpoint from configuration, or a SubmitForm request. Some look up the email domain's MX record before sending the form.
The retry count and transport change across copies, while the address-derived branding, prefilled identity and final redirect remain consistent.
Encoded wrappers preserve the same browser flow
Some pages place the entire HTML document in Base64 and open it with document.write. Another branch uses an XOR-decoded virtual machine to construct the request. Once decoded, both still read the address from the link, collect repeated passwords and redirect to the derived domain.
What we see
| Month | New sites |
|---|---|
| September | 200 |
| October so far | 50 |
Among successful captures since 25 September, 2 of 89 Legokit sites ran WordPress.
Checking a Legokit page
Open the complete reported link with test data and preserve the network log. Look for:
- an email address read from the URL fragment or query string
- a read-only, prefilled email field
- a favicon, logo or screenshot requested for the email domain
- repeated password submissions followed by a redirect to that domain
- requests to the Telegram Bot API, a local PHP handler or a configured form endpoint
- IP, location or MX lookups immediately before collection
- a Base64 or XOR-decoded document opened with
document.write
Remove the page, its local handlers and each hosted copy. Review the hosting and deployment accounts and rotate their credentials.