LogoKit Being Leveraged For Credential Theft

This report details an ongoing LogoKit-based phishing campaign impersonating trusted entities (including HunCERT, Kina Bank and charities) that hosts credential-harvesting pages on Amazon S3, uses Cloudflare Turnstile and dynamic logo/favicon fetching via Clearbit/Google to increase legitimacy, and exfiltrates credentials to mettcoint.com; the domain was registered October 2024, active since February 2025, and currently has zero VirusTotal detections, with several phishing URLs and PHP endpoints provided as IOCs.