> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes - URL: https://f4n6.co.uk/security-feed/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutes/ - Published: 2026-10-07T15:06:42.000Z - Updated: 2026-10-07T15:06:42.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary BlueKit, a phishing-as-a-service (PhaaS) platform tracked by Malwarebytes since it appeared on a cybercrime forum in April 2026, now ships 176 phishing page variants impersonating 97 brands, including corporate SSO gateways and business platforms such as Salesforce, HubSpot, GitHub, Check Point, Citrix, Cloudflare and Cisco. The kit captures device fingerprints, session cookies and passkeys rather than credentials alone, which lets an operator replay a stolen session and bypass both password and MFA checks. Operators advertise a working phishing site within roughly 10 minutes of connecting a domain, at a floor price of $250 for seven days, and claimed more than 1,000 customers as of 29 August 2026\. No CVE, CISA KEV entry or CVSS score applies: this is an abuse-of-legitimate-authentication item, not a software vulnerability. For EMEA financial services the exposure is session-token theft against workforce and customer identity providers, which defeats MFA and is not remediated by patching. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | BlueKit's session-cookie and passkey theft produces account takeover that may not raise a conventional authentication alert, so detection depends on the firm's own incident management process rather than a vendor advisory. | Firms need a defined detection and escalation path for anomalous session reuse and impossible-travel logins, and must be able to reconstruct the timeline from identity provider logs. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The service is a subscription cyber threat with a named template set covering SSO gateways and security vendors, which is the kind of threat information Art. 18 classification covers. | Account-takeover events traced to this kit must be classified consistently, including where no malware is present on the endpoint. | | NIS2 Art. 21(2)(d): supply chain security measures | BlueKit templates impersonate third-party platforms the firm depends on (Salesforce, HubSpot, GitHub, Cloudflare, Cisco, Citrix), so the phishing vector runs through the supply chain rather than the firm's own perimeter. | Third-party and SaaS access controls, including phishing-resistant authentication on those platforms, fall inside the supply chain measures the firm is expected to have. | ## 3\. Technical analysis & attack chain BlueKit is a hosted PhaaS platform, not an exploit. There is no CVE, no vulnerable component and no patch. The attack chain below reflects what Malwarebytes describes; every step is single-sourced to that vendor's research team and should be treated as vendor-reported until independently corroborated. 1. The operator buys a subscription (cheapest tier $250 for seven days) and connects a domain to the BlueKit dashboard. Malwarebytes reports the operators claim a phishing site is ready in around 10 minutes. 2. The operator selects a template from the library: 97 brands across 176 variants as of September 2026\. Consumer targets include Amazon, Booking.com, Google/Gmail, Apple, American Express, Bank of America, cryptocurrency exchanges, TikTok, Facebook, X, OpenAI and Anthropic. Business targets include Salesforce, HubSpot, GitHub, Check Point, Citrix, Cloudflare and Cisco. 3. Delivery runs by email or, since the 10 August 2026 release of the built-in SMS sender, by smishing sent directly from the dashboard. The operators claim the SMS tool can send from local US phone numbers. 4. The victim lands on the cloned login page and authenticates. BlueKit captures the submitted credentials and, in the same interaction, collects a device fingerprint (IP address, browser details, screen size, operating system, hardware characteristics), session cookies and passkeys. 5. The operator imports the stolen session cookie into their own browser and reaches the account without the password and without a second-factor prompt, because the target service treats the replayed session as already authenticated. Malwarebytes describes this as pasting the cookie and walking into the active account. 6. The kit also includes a built-in AI assistant with safety filters removed, which the operators advertise as answering "even extreme prompts" and assisting with "fraud-related questions". Malwarebytes states attackers can use it to generate phishing emails and fake text messages. The device fingerprint matters as much as the cookie. Security systems that check for a recognised device to confirm identity can be satisfied by replaying the captured fingerprint alongside the session, which is why the theft of fingerprint data and session data together is more useful to the operator than either alone. Two claims in the source are the operators' own marketing and are not independently verified: the 10-minute deployment time and the ability to send from local US numbers. Malwarebytes reports the 1,000-customer milestone as an operator announcement dated 29 August 2026, and its revenue figures are explicitly hypothetical, based on advertised prices with the actual subscription mix unknown. Do not treat the revenue estimate as intelligence. No threat actor is named in the source and no MITRE ATT&CK profile is available for this item. Attribution to any specific group is unconfirmed and Adverse Trace does not make one. ## 4\. Mitigation & containment P1 within 24 hours - Enforce phishing-resistant authentication (FIDO2/WebAuthn hardware keys or passkeys bound to the device) on the identity provider and on the named business platforms: Salesforce, HubSpot, GitHub, Check Point, Citrix, Cloudflare, Cisco. Session-cookie replay defeats TOTP and push-based MFA; it does not defeat a bound authenticator. - Shorten session lifetimes and enable continuous or token-binding checks on the identity provider and the SaaS platforms above, so a replayed cookie expires before it is useful. - Hunt identity provider logs for session reuse from a new IP or device where the session token was issued to a different fingerprint. Treat a valid session presenting from an unexpected device as a P1 alert, not a low-confidence signal. - Block or quarantine inbound mail and SMS-linked URLs that resolve to newly registered domains hosting cloned login pages for the brands listed in §3\. Where the firm has brand protection, add the 97 impersonated brands to the takedown watchlist. P2 within 72 hours - Add the business platforms in §3 to the conditional access policy set that requires a compliant, managed device, so a stolen cookie replayed from an unmanaged browser fails the device check. - Review passkey and WebAuthn registration events for the last 90 days for registrations the user cannot confirm, since BlueKit captures passkeys as well as cookies. - Brief service desk and fraud teams that a convincing login page and correct branding are not evidence of legitimacy, and that a user reporting a suspicious login should trigger session revocation, not just a password reset. Password reset alone does not invalidate a stolen session cookie; revoke sessions explicitly. P3 within 7 days - Extend the session-reuse detection in P1 to customer-facing banking and payment portals, not just workforce identity. - Test the session-revocation runbook end to end: confirm that revoking sessions on the identity provider also terminates sessions on each federated SaaS platform. No vendor patch exists for this item. There is no software fix; the controls above are configuration and identity changes. ## 5\. Indicators of compromise No atomic indicators of compromise are available in the source material. Malwarebytes publishes no domains, IP addresses, hashes, file paths or registry keys for BlueKit. The platform is a hosted service reached through operator-supplied domains that change per campaign, so no stable network indicator can be derived from this reporting. The source does describe observable behaviours. These are the detection surface for this item. ### Behavioural indicators | behaviour | where to observe | confidence | | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------- | | Session cookie presented from a device or IP that does not match the fingerprint recorded at login | Identity provider and SaaS access logs | Medium; behaviour described by Malwarebytes, no atomic values published | | Successful authentication with no corresponding MFA challenge where policy requires one | Identity provider authentication logs | Medium | | Passkey or WebAuthn credential registered shortly after a login from a new device | Identity provider credential registration events | Medium | | Login to Salesforce, HubSpot, GitHub, Check Point, Citrix, Cloudflare or Cisco from an IP with no prior history for that user | SaaS platform audit logs | Medium | | Inbound SMS containing a link to a cloned login page for one of the 97 impersonated brands | Mobile telemetry, user reports | Low; SMS delivery capability is operator-claimed and not independently verified | ## 6\. Detection The source contains no file artefacts, command lines, mutexes, registry keys or filenames. It provides brand names and platform names only, which are not artefacts of the threat and would produce rules that match reporting about BlueKit rather than BlueKit activity. No YARA rule is emitted for that reason. A Sigma rule is possible against the behavioural indicator that matters most: a session token reused from a device that does not match the fingerprint recorded at issuance. The rule below is a template. The field names are placeholders for the firm's identity provider schema and must be mapped before deployment. ```yaml title: Session Token Reuse From Mismatched Device Fingerprint id: 8f3c1a92-4d7e-4b21-9c55-0a6e2f7b1d34 status: experimental description: Detects a valid session token presented from a device or IP that does not match the fingerprint recorded when the session was issued, consistent with session-cookie replay used by BlueKit and similar PhaaS kits. author: Adverse Trace date: 2026/10/07 references: - https://www.malwarebytes.com/blog/threat-intel/2026/10/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutes logsource: product: identity_provider service: authentication detection: selection: event_type: 'session_token_used' session_valid: true filter_baseline: device_fingerprint_match: true condition: selection and not filter_baseline fields: - user_id - session_id - source_ip - device_fingerprint - user_agent falsepositives: - Legitimate user on a new device where the fingerprint has not yet been enrolled - Corporate proxy or VPN egress change altering the observed source IP mid-session level: high ``` Deploy this against the identity provider first, then against the SaaS platforms named in §3\. Tune the false positive cases before enabling automated response. ## 7\. Sources - Malwarebytes, "AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes", https://www.malwarebytes.com/blog/threat-intel/2026/10/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutes, 2026-10-07. This advisory rests on a single vendor source. The template counts, pricing, customer milestone and SMS capability are reported by Malwarebytes from its own tracking and from operator announcements. No second source corroborates them. ## 8\. Adverse Trace position Adverse Trace assesses this as a high-impact, low-severity-classification item: there is no CVE and no CVSS score to assign, but session-cookie and passkey theft against SSO gateways defeats MFA and is the control most EMEA financial services firms rely on for remote access. The exposure is concentrated in firms that use push or TOTP MFA on Salesforce, HubSpot, GitHub, Cloudflare, Cisco, Citrix or Check Point without device binding, because a replayed cookie clears those checks. The reporting is single-sourced to Malwarebytes and the operator claims within it are unverified; we treat the template library and session-theft capability as credible and the 10-minute deployment and revenue figures as marketing until corroborated. We will monitor for additional vendor reporting on BlueKit, for published campaign domains that would give clients enforceable network indicators, and for any shift in the template set toward EMEA banking brands, and we will issue a follow-up if atomic indicators become available. Clients who cannot move to phishing-resistant authentication within 24 hours should prioritise session lifetime reduction and session-reuse alerting on the identity provider, since those two controls address the replay step directly. --- [Read the original source →](https://www.malwarebytes.com/blog/threat-intel/2026/10/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutes?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*