Bluekit phishing kit adopts browser-in-the-middle for login theft

1. Executive summary

The Bluekit phishing-as-a-service (PaaS) platform has added browser-in-the-middle (BitM) capabilities, replacing its previous adversary-in-the-middle approach. The upgrade uses the open-source rrweb JavaScript library to stream a victim's DOM interactions over a WebSocket to an attacker-controlled browser session, enabling full session-token theft with high visual fidelity. Netcraft reports nearly 70 new hostnames in the past week, expanding the kit's infrastructure footprint. No verified CVE data, CVSS scores, or CISA-KEV entries are associated with this item — this is a criminal tool evolution, not a product vulnerability. EMEA financial services face elevated account-takeover (ATO) and business email compromise (BEC) risk as the kit's anti-analysis features complicate detection and takedown.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from source material)

1. Infrastructure deployment. Bluekit operators rotate infrastructure rapidly — nearly 70 new hostnames identified in the week prior to the report. Phishing domains host credential-harvesting pages targeting popular services: Outlook, Hotmail, Gmail, Yahoo, ProtonMail, iCloud, GitHub, and Ledger.
2. Lure delivery. Bluekit's integrated AI assistant drafts phishing emails using multiple LLMs: Llama, GPT-4.1, Claude, Gemini, and DeepSeek. Forty distinct phishing templates are available to "customers."
3. Victir qualification / anti-analysis. Before presenting the credential-harvesting page, Bluekit runs a victim-qualification system to filter out researchers and security crawlers. Anti-analysis mechanisms include: - Randomized CSS filters on top-level HTML elements to defeat screenshot-based detection. - A large (>1 MB), frequently changing obfuscated JavaScript bundle. - Custom CAPTCHA that may imitate Cloudflare or the target brand. - Browser fingerprinting: RAM, CPU cores, screen resolution, language, headless browser detection, anti-fingerprinting extension detection. - WebRTC-based IP mismatch detection to identify users behind proxies or VPNs.
4. BitM session establishment. The victim's browser loads the phishing page, which uses the open-source rrweb library to serialize the page's DOM and stream it over a WebSocket connection to the attacker's browser. The attacker's browser loads the legitimate login page.
5. Credential relay. The victim interacts with what appears to be a legitimate login page. Images, fonts, and CSS are fetched through the phishing infrastructure. Victim keyboard inputs and mouse clicks are forwarded to the attacker's browser, which relays them to the target service.
6. Session-token capture. Authentication completes in the attacker's browser, granting the attacker a valid session token with unlimited access to the victim's account. The attacker holds the authenticated session independent of the victim's continued interaction.
7. Post-login monitoring. Bluekit's live monitoring system (5-second update interval), previously documented by Varonis, remains operational. Operators can monitor victims during deceptive login sessions and track actions after login.

Key technical characteristics

• BitM mechanism: Uses rrweb (legitimate open-source session-replay library) for DOM serialization over WebSocket. Chosen for visual fidelity, real-time interactivity, and bandwidth efficiency.
• Latency indicator: Some latency persists in the relay — keyboard input and mouse click delays on login pages are a detection signal.
• Infrastructure scale: ~70 new hostnames in the reporting week; infrastructure rotates continuously.
• Targeted services: Outlook, Hotmail, Gmail, Yahoo, ProtonMail, iCloud, GitHub, Ledger — a mix of corporate email, consumer email, cloud storage, developer platforms, and hardware-wallet vendors.

Confidence caveat: The technical detail in this advisory is single-sourced (Netcraft report via BleepingComputer). The April Varonis documentation corroborates the earlier Bluekit capabilities (AI assistant, templates, live monitoring) but the BitM/rrweb evolution is reported solely by Netcraft. Verify before enforcement.

Attribution: No named threat actor is identified in the source material. No MITRE ATT&CK group profile is available. Attribution is unconfirmed — treat as "uncategorised criminal operator(s) using Bluekit PaaS."

4. Mitigation & containment

P1 — Within 24 hours

• Block known infrastructure. Ingest the ~70 new hostnames identified by Netcraft into DNS sinkholing, proxy blocklists, and email security gateway URL filters. Source the full hostname list from the Netcraft report (not reproduced in the BleepingComputer summary).
• Deploy FIDO2 hardware keys. Phishing-resistant MFA (FIDO2/WebAuthn) is the primary control against BitM session-token theft. Password + OTP/TOTP is insufficient — the attacker's browser completes authentication and receives the session token. Priorise rollout to executive, finance, and treasury teams first.
• Alert on session-token anomalies. Configure IdP/SSO logs to alert on: session-token issuance from unfamiliar IPs, concurrent sessions from geographically distant locations, and session-token replay from infrastructure-as-a-service IP ranges.

P2 — Within 72 hours

• Hunt for rrweb on non-analytics domains. Search web-proxy logs and CASB logs for rrweb library inclusion on domains that are not known analytics/session-replay providers. rrweb is legitimate — context matters. Flag domains where rrweb appears alongside WebSocket connections transmitting encrypted/binary data on login pages.
• Hunt for WebSocket + login-page combinations. Search proxy logs for WebSocket upgrade requests (Upgrade: websocket) on domains serving login forms. Legitimate login pages rarely use WebSocket during authentication.
• Hunt for CSS filter manipulation. Search web-proxy logs or CASB for top-level HTML elements with randomized CSS filter values — a Bluekit anti-analysis signature.
• Hunt for >1 MB obfuscated JS bundles. Review proxy logs for domains serving large, frequently changing obfuscated JavaScript bundles on login pages.
• Brief SOC on latency detection. Train analysts to treat user-reported keyboard/mouse-click lag on login pages as a potential BitM indicator. Add this to phishing-report triage playbooks.

P3 — Within 7 days

• Review email-security controls. Bluekit's AI-generated phishing emails use multiple LLMs. Ensure email security gateways perform content analysis rather than relying solely on reputation/URL reputation. Consider behavioural-AI email security for BEC detection.
• Update phishing-awareness training. Educate users on BitM indicators: unusual login-page latency, visual artefacts from DOM relay, and the fact that the page may look identical to the legitimate service.
• Engage takedown partners. Route identified Bluekit hostnames to your brand-abtection / digital-risk partner for registrar-level takedown. Expect rapid infrastructure rotation — takedown is a containment measure, not a permanent fix.
• Review conditional-access policies. Enforce device-trust and compliant-device requirements for access to email and collaboration platforms. A session token stolen via BitM used from an unmanaged device or browser should be blocked by CA policy.

5. Indicators of compromise

The source material provides behavioural signals and infrastructure patterns but does not provide concrete IOCs (no domains, IPs, file hashes, or URLs are listed in the article text). The following are detection signals, not atomic IOCs:

No indicators of compromise available in the source material as atomic values (domains, IPs, hashes). The signals above are behavioural patterns for detection-rule authoring, not blocklist entries.

6. Detection

rule Bluekit_Phishing_Kit_BitM_Signals {
  meta:
    author = "Adverse Trace"
    date = "2026-06-25"
    reference = "https://www.bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/"
    description = "Detects Bluekit phishing kit browser-in-the-middle infrastructure signals: rrweb library inclusion, obfuscated JS bundle, CSS filter manipulation, WebSocket binary data on login pages, WebRTC IP mismatch detection, custom CAPTCHA imitation"
  strings:
    $rrweb = "rrweb" nocase
    $websocket_binary = "WebSocket" nocase
    $css_filter = "filter:" nocase
    $webrtc = "WebRTC" nocase
    $captcha_cloudflare = "cloudflare" nocase
    $obfuscated_bundle = "function(" nocase
    $fingerprint_ram = "RAM" nocase
    $fingerprint_cpu = "CPU" nocase
    $fingerprint_screen = "screen" nocase
    $fingerprint_headless = "headless" nocise
    $fingerprint_antifp = "anti-fingerprinting" nocase
    $dom_serialize = "DOM" nocase
    $session_replay = "session" nocase
  condition:
    #rrweb > 0 and (#websocket_binary > 0 or #dom_serialize > 0) and (#css_filter > 0 or #webrtc > 0 or #fingerprint_ram > 0 or #fingerprint_cpu > 0 or #fingerprint_headless > 0 or #fingerprint_antifp > 0)
}

title: Bluekit BitM Phishing - WebSocket Activity on Login Page
id: 0c1e2a3b-4d5e-6f70-8192-a3b4c5d6e7f8
status: experimental
description: Detects WebSocket upgrade requests on domains serving login pages, consistent with Bluekit browser-in-the-middle phishing using rrweb DOM serialization
references:

  - https://www.bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/
author: Adverse Trace
date: 2026/06/25
logsource:
  product: web.proxy
  service: http
detection:
  selection:
    request.method:

      - GET
    request.headers.upgrade:

      - websocket
    request.uri:

      - "*login*"
      - "*signin*"
      - "*auth*"
      - "*sso*"
  filter_legitimate:
    request.headers.host:

      - "*.google.com"
      - "*.microsoft.com"
      - "*.microsoftonline.com"
      - "*.apple.com"
      - "*.github.com"
  condition: selection and not filter_legitimate
falsepositives:

  - Legitimate session-replay or analytics platforms using WebSocket on authenticated pages
  - Single-page applications with WebSocket-based real-time features on login-adjacent paths
level: medium

title: Bluekit BitM Phishing - rrweb Library on Non-Analytics Domain
id: 1d2e3f4a-5b6c-7d80-9123-b4c5d6e7f8a9
status: experimental
description: Detects rrweb JavaScript library inclusion on domains not associated with known analytics or session-replay providers, consistent with Bluekit browser-in-the-middle phishing
references:

  - https://www.bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/
author: Adverse Trace
date: 2026/06/25
logsource:
  product: web.proxy
  service: http
detection:
  selection:
    response.body:

      - "*rrweb*"
  filter_legitimate:
    request.headers.host:

      - "*.logrocket.com"
      - "*.fullstory.com"
      - "*.hotjar.com"
      - "*.smartlook.com"
      - "*.contentsquare.com"
      - "*.amplitude.com"
      - "*.mouseflow.com"
  condition: selection and not filter_legitimate
falsepositives:

  - Legitimate use of rrweb for in-house session-replay or product-analytics on corporate domains
  - Development or staging environments testing rrweb integration
level: medium

7. Sources

• BleepingComputer, "Bluekit phishing kit adopts browser-in-the-middle for login theft," https://www.bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/, 2026-06-25
• Netcraft (referenced via BleepingComputer), report on Bluekit BitM evolution, 2026-06-25
• Varonis (referenced via BleepingComputer), initial Bluekit documentation, April 2026

8. Adverse Trace position

This is a advisory. No verified CVE, CVSS, or CISA-KEV data applies — Bluekit is a criminal phishing-as-a-service tool, not a product vulnerability. The core risk to EMEA financial services is elevated ATO and BEC exposure: BitM via rrweb produces session tokens that bypass OTP/TOTP MFA, and the kit's anti-analysis features (randomized CSS filters, >1 MB rotating obfuscated JS, browser fingerprinting, WebRTC IP-mismatch detection, custom CAPTCHA) degrade automated detection. Attribution is unconfirmed — no named actor or MITRE profile is available. The technical detail is single-sourced (Netcraft via BleepingComputer); we assess the reporting as credible given Varonis's prior corroboration of Bluekit's earlier capabilities, but the BitM/rrweb evolution should be verified before enforcement actions. Adverse Trace will continue to monitor for disclosed Bluekit hostnames and will issue a update if multi-source corroboration or concrete IOCs become available. Clients should prioritise FIDO2 hardware-key rollout and proxy-log hunting for rrweb + WebSocket on login pages.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.