Researchers said that unlike other phishing kits that take advantage of complex layouts and multiple files, the LogoKit family is an embeddable set of JavaScript functions. These kits interact within the Document Object Model (DOM), allowing the script to dynamically alter the visible content and HTML form data within a page without user interaction. RiskIQ security researcher Adam Castleman said his company had observed more than 700 domains running with LogoKit. Targeted services range from generic login portals to false SharePoint portals, Adobe Document Cloud, OneDrive, Office 365, and cryptocurrency exchanges. RiskIQ has also observed attackers targeting several sectors, including financial, legal, and entertainment.