A Phishing Platform That Refuses to Stand Still
The cybercriminal ecosystem rarely stays idle, and Bluekit — a phishing-as-a-service (PhaaS) platform first identified earlier this year — is proving that point with uncomfortable regularity. In the span of a single week, researchers tracking the platform discovered nearly 70 new hostnames associated with its infrastructure. More significantly, Bluekit's operators have now integrated a browser-in-the-middle (BitM) attack mechanism, a technique that fundamentally changes how credentials and session tokens are stolen from victims.
For security professionals already grappling with increasingly commoditized phishing toolkits, Bluekit represents a troubling benchmark: a commercial-grade attack platform that iterates quickly, absorbs cutting-edge techniques, and lowers the bar for sophisticated credential theft to near zero.
From Adversary-in-the-Middle to Browser-in-the-Middle: What Changed and Why It Matters
Bluekit previously relied on adversary-in-the-middle (AiTM) techniques to intercept credentials. Its operators have now pivoted to a BitM architecture — a distinction that carries meaningful implications for both attackers and defenders.
In a BitM attack, the victim is not interacting with a cloned or replicated login page. Instead, they are interacting with a real browser session running on attacker-controlled infrastructure, which loads the genuine target website and relays all activity back and forth. Authentication completes entirely within the attacker's browser. The result is a valid, live session token — not just a stolen password — granting unfettered access to the victim's account even when multi-factor authentication is in place.
To enable this, Bluekit's latest iteration uses rrweb, a legitimate open-source JavaScript library originally designed for session replay and analytics. The library serializes the page's Document Object Model (DOM) and streams it to the victim over a WebSocket connection. Images, fonts, and stylesheets are served through the phishing infrastructure, while every keystroke and mouse click is relayed back to the attacker's browser in real time.
The use of a trusted, widely deployed open-source library is a deliberate choice — it complicates detection and forces defenders to evaluate rrweb's presence within broader behavioral context rather than treating it as a standalone indicator of compromise.
The BitM concept has existed since 2022, but its integration into a turnkey, commercially available phishing kit marks a significant escalation in accessibility. Sophisticated techniques that once required skilled threat actors are now available to virtually anyone willing to pay for a subscription.
Built to Evade: Bluekit's Anti-Analysis Stack
What distinguishes Bluekit from more rudimentary phishing kits is not just its attack mechanism — it is the depth of its evasion infrastructure. Before a victim ever sees a fake login page, the platform runs a comprehensive qualification process designed to filter out security researchers, automated crawlers, and sandboxed environments.
The platform's anti-analysis capabilities include:
Together, these mechanisms create a layered filter that maximizes the ratio of genuine victims to security analysts encountering the platform. Operators also retain access to a live monitoring dashboard — updated every five seconds — that allows them to observe victims in real time as they navigate the phishing session and track post-login behavior.
Spotting the Signals Without Confirmed Indicators
One of the investigative challenges with Bluekit is that many of its components, taken individually, are not inherently malicious. Security teams should be aware of behavioral signals that, in combination, suggest Bluekit activity:
- CSS filter manipulation on top-level HTML elements with randomized values
- Periodically rotating, obfuscated JavaScript bundles of unusual size
- Browser fingerprint enumeration activity on landing or login pages
- WebSocket connections transmitting encrypted or binary data during login flows
- WebRTC IP mismatch detection on the landing page
One practical red flag for end users: perceptible input latency on login pages. Because keystrokes and clicks must travel through the attacker's infrastructure before reaching the legitimate service, BitM attacks introduce subtle but measurable delays. Any login page that feels sluggish or unresponsive warrants immediate suspicion.
What You Should Do
For Security Teams
- Implement phishing-resistant MFA: FIDO2/passkey-based authentication cannot be relayed through a BitM proxy. Prioritize its deployment for privileged and high-value accounts.
- Deploy browser isolation technology: Remote browser isolation can neutralize BitM attacks by preventing attacker-controlled browser sessions from interacting with corporate credentials.
- Monitor for anomalous WebSocket activity: Establish baselines for WebSocket usage in your environment and flag connections that transmit binary or encrypted data on authentication pages.
- Invest in behavioral email security: Bluekit's AI-assisted email drafting capability makes phishing lures increasingly convincing. Signature-based filters alone are insufficient — behavioral analysis of email patterns is essential.
- Threat-hunt for PhaaS infrastructure: Correlate newly registered hostnames, suspicious TLS certificate patterns, and known Bluekit signals in your threat intelligence feeds.
For End Users
- Be skeptical of any login page that loads slowly or exhibits input lag — this can indicate a BitM relay in progress.
- Verify URLs carefully, particularly for financial, email, and cloud service logins.
- Report suspicious login experiences to your IT or security team immediately, even if you completed authentication successfully.
The Broader Picture
Bluekit is not an isolated threat — it is a symptom of a maturing criminal marketplace where sophisticated attack capabilities are packaged, sold, and continuously updated like commercial software products. The platform's rapid feature additions, coupled with its growing infrastructure footprint, suggest well-resourced operators with both technical depth and market ambition.
For security leaders, the emergence of platforms like Bluekit demands a fundamental reassessment of phishing defense strategies. The era of static login page clones is giving way to dynamic, session-hijacking attacks that can defeat traditional MFA and bypass most conventional detection. The organizations that adapt now will be far better positioned than those waiting for a breach to prompt the conversation.
