The Bluekit phishing kit has received a significant upgrade that allows cybercriminals to steal authenticated user sessions more effectively. Security researchers have discovered that the phishing-as-a-service (PhaaS) platform now supports browser-in-the-middle (BitM) attacks, replacing its previous interception technique with a more advanced method for compromising online accounts.
The latest version also introduces additional evasion capabilities, making the platform more difficult for researchers and automated security tools to detect.
Bluekit Expands Its Phishing Capabilities
Bluekit first came to light earlier this year when researchers revealed a phishing platform that combined AI-powered email generation with customizable phishing pages. The service includes support for several large language models, enabling operators to quickly create convincing phishing emails targeting a wide range of online services.
The platform originally offered around 40 phishing templates for providers such as Outlook, Gmail, Yahoo, ProtonMail, iCloud, GitHub, and Ledger. Since then, researchers have identified nearly 70 new hostnames linked to Bluekit, suggesting the operation continues to expand.
Browser-in-the-Middle Improves Credential Theft
According to a new report from Netcraft, Bluekit now relies on browser-in-the-middle technology instead of the adversary-in-the-middle approach used previously.
Rather than displaying a fake login page, attackers present victims with a real website running inside a browser session they control remotely. Every interaction, including mouse clicks and keyboard input, is forwarded to the attacker’s browser while responses from the legitimate website are sent back to the victim.
To make this possible, Bluekit uses rrweb, an open-source JavaScript library commonly deployed for session replay and analytics. Researchers emphasize that rrweb itself is legitimate software and should not be considered malicious outside the context of this attack.
Because victims authenticate against the genuine website, attackers receive a valid session token once the login process finishes. That token allows them to access the compromised account without repeatedly requesting credentials.
Users may notice slight delays when typing or clicking during a phishing session, as the browser interactions must travel through the attacker’s infrastructure.
New Defenses Against Security Researchers
The updated Bluekit phishing kit also includes several mechanisms designed to identify researchers before the phishing process begins.
Among the new anti-analysis techniques are randomized CSS filters that interfere with screenshot-based detection, heavily obfuscated JavaScript files that change regularly, fake CAPTCHA pages resembling Cloudflare or the targeted brand, browser fingerprinting, and WebRTC-based IP checks that can detect VPN or proxy connections.
These layers make it harder for security teams to analyze phishing pages or automatically identify malicious infrastructure.
Real-Time Victim Monitoring Remains Available
Netcraft also confirmed that Bluekit still provides operators with a live monitoring dashboard previously documented by Varonis.
The interface refreshes every five seconds, allowing attackers to watch victims interact with phishing pages as events unfold. Operators can monitor login attempts in real time and continue observing activity after a successful authentication.
Security Teams Should Watch for Behavioral Indicators
Instead of publishing traditional indicators of compromise, researchers recommend looking for a combination of suspicious behaviors associated with Bluekit.
Potential warning signs include unusual CSS filter manipulation, frequently changing obfuscated JavaScript bundles, browser fingerprinting routines, WebSocket connections transmitting encrypted or binary data on login pages, and WebRTC checks that compare a visitor’s IP address.
While none of these behaviors alone confirms malicious activity, multiple indicators appearing together may reveal an active Bluekit phishing kit campaign targeting users or organizations.
Why the Update Matters
The addition of browser-in-the-middle technology shows how phishing platforms continue to evolve beyond simple credential harvesting. By stealing authenticated sessions instead of just usernames and passwords, attackers can bypass some security controls and gain immediate access to victim accounts.
Organizations should continue educating users about phishing threats while monitoring for abnormal login behavior and deploying phishing-resistant authentication wherever possible.
0 responses to “Bluekit Phishing Kit Adds Browser-in-the-Middle Attacks to Steal Accounts”