Within a few minutes, three emails landed in our support inbox. One confirmed a wire transfer. Another warned that an inbox was full. A third flagged a new Windows sign-in. Each came from ‘IT Support’, and each carried the same link.

That link is the trigger of the campaign. Click it, and it slips through an open redirect on medium.com before landing on a page hosted on Tencent EdgeOne Pages. There, a login page builds itself around whoever clicked: the recipient’s own website fills the background, and their favicon sits quietly in the browser tab.

RiskIQ coined the term LogoKit phishing in 2021. Five years later, this phishing attack is back.

In this article, we’ll walk through what LogoKit phishing is, what we observed in this case, and the specific details that caught our analyst team’s attention.

• How the page builds itself on EdgeOne Pages
• How the ShareMyHTML variant differs from the EdgeOne Pages version
• Why a phishing page would collect your IP address
• One sending domain, many campaigns
• A LogoKit phishing checklist for you 

What is LogoKit phishing, and what is new in this case?

LogoKit is a phishing scam. The LogoKit phishing kit uses mostly free tools to build a login page for every target in real time. RiskIQ named it in January 2021, when the URL already carried the target’s email address. Resecurity, a security firm, said it spread through open redirects in August 2022. This year, Barracuda’s 29 July 2026 report showed how LogoKit is fast becoming phishing-as-a-service (PhaaS) and included live screenshots of a target’s own site, with credentials sent to a Telegram bot.

The Abusix in-house analyst team recently noticed three distinct elements of this phishing campaign. First, the pages sit on EdgeOne Pages, a hosting service that Kaspersky noted attackers abusing in June 2026. Second, the credentials our team used in testing went to a domain the attacker seems to own, not to a Telegram account. Third, a second variant uses ShareMyHTML, which MalwareTips documented as being used in a different scam in September 2026.

Each email used a different phishing hook, but all used the same link:

• A wire transfer payment confirmation
• A warning that incoming messages had failed and the inbox was full
• A security alert about a new sign-in on Windows

These are common use cases for action-driven emails, engineered to catch the intended target’s attention and prompt a click. The only constant identified is the link, which leads to the same login page. In isolation, they look like separate incidents, but side by side, the shared link ties all three together.

How does the page build itself on EdgeOne Pages?

1. When someone clicks, the link first passes through an open redirect on medium.com before landing on the EdgeOne page.
2. The link includes the target’s email address as a URL fragment after the #. The phishing page reads this to decide which website to copy for the background.
3. As the page loads, it calls several free services; one grabs a screenshot of the target’s website for the background, Google’s favicon service provides the browser tab icon and the login frame, and Clearbit is also called (even though HubSpot, owner of ClearBit, ended its free Logo API in December 2025), the kit still includes the request.
4. Stolen details go to a separate domain, which in this case appears to be the attacker’s only piece of infrastructure. 
5. The page then delays the process to encourage the target to confirm their login credentials. 

 

In our test with dummy details, it first claimed the password was invalid and prompted us to try again, then displayed an ‘expired document’ message before redirecting to the real site. Asking for the password twice helps confirm it and may also slow analysts, who typically enter junk data once. That second point is our interpretation, not a confirmed tactic.

We saw no sign of generative AI on the LogoKit page itself; the kit uses free tools to grab the favicon, logo, and a screenshot of the targeted website, then places them on the page. However, Kaspersky noted that EdgeOne Pages lets attackers publish pages quickly with AI, reducing their effort. That AI sits in the hosting platform, not in how the kit builds the login page.

How does the ShareMyHTML variant differ from the EdgeOne Pages version?

• A pre-built page – Unlike the EdgeOne Pages version, it uses stock images instead of a live screenshot of the target’s site.
• IP lookups – It also looks up the visitor’s IP address and location.
• A different payload route – Instead of a domain the attacker owns, it submits through Formspark, a free form service. We found data like email, password, attempts, IP address, location, country, timestamp, and user agent.

Why would a phishing page collect your IP address?

Our data analyst team’s findings support two assumptions:

• To confirm the page reaches its intended targets; possibly for campaign statistics, such as who falls for it and where.
• To manage country filtering; the server-side lock many phishing pages use to send visitors outside the target country to a legitimate site.

Evidence suggests the first explanation holds most truth, as the lookup results are sent with the stolen credentials, letting the operator record each target’s location. The second option remains possible, but we have not seen clear evidence.

25,110 LogoKit phishing hits in three months

The sending domain dates back to 2017, but appears to have been hijacked and recently became the source of the phishing campaign, which is when it started showing up in our spam trap data. This is not a single-campaign domain. Alongside LogoKit, we see wire-transfer scams, fake file-sharing alerts, payment-receipt scams, and spam from multiple senders. Another domain showed a similar spike in LogoKit phishing at the same time. Our data shows 25,110 hits from 18 July to 16 October 2026, alone. 

What this means for your abuse desk

When three different phishing hooks arrive within minutes, it’s easy to treat them as separate incidents. In cases like this, though, they’re clearly part of the same campaign, so it’s more effective to triage by the shared link than by subject or hook.

What to check this week

1. Check your mail gateway’s link logs for Medium redirect URLs where the redirectUrl parameter points to an edgeone.dev address.
2. Review the full link in the message body. The email address appears after the #, which browsers do not send to servers, so you won’t see it in proxy logs.
3. If you see a burst of ‘IT support’ emails, group them using the link before triaging by subject line.
4. Check your DNS and proxy logs for requests from user devices to edgeone.dev subdomains and ShareMyHTML pages. Some legitimate use is expected.

The case for automated network abuse management

This is where Abusix Ops and Abusix Mail fit in, helping you manage network abuse from inside and outside your network. If a sender like this one sits on your own network, the reports about it arrive in different shapes for different campaigns. Abusix Ops normalizes them and groups them into one case per account, so one sender used for several campaigns reads as one problem, and your analysts keep the case history, the override, and the final call. For mail arriving from outside, Abusix Mail rejects known-bad senders at the edge before anything gets scanned. This is how you build automated network abuse management and protect your customers and employees from sophisticated phishing attacks. 

FAQs

What is LogoKit phishing?

A phishing kit builds a login page around the target in real time, using their website and favicon pulled from free services.

How can you spot a LogoKit phishing page?

Your website appears in the background, with your favicon in the tab. The link may go through a legitimate site’s redirect.

What are EdgeOne Pages?

Tencent’s hosting service is used to publish web pages. Kaspersky reported attackers abusing it in June 2026, and in our case, we hosted the LogoKit page there.

Do these pages use AI?

We saw no sign of it on the LogoKit page, which is a template stitched to free services. However, Kaspersky describes EdgeOne Pages, where the page was hosted, as an AI-assisted publishing service that reduces the effort of building pages. The LogoKit template itself does not rely on AI.