PhishingPublished 25 Jun 2026

Bluekit phishing kit adopts browser-in-the-middle for login theft

Source Bleeping Computer

Description

The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft. [...]

Impact

Successful exploitation results in attackers obtaining valid session tokens and full access to victims' accounts on targeted services. The use of BitM allows attackers to bypass traditional credential theft detection by interacting with legitimate login pages in real time. The advanced anti-analysis features reduce the likelihood of detection by security researchers and automated systems, increasing the threat's effectiveness and persistence.

Defensive guidance

Defenders should educate users to recognize signs of BitM phishing, such as input delays or unusual login page behavior. Security teams should enhance phishing detection capabilities, including monitoring for WebSocket connections on login pages and suspicious JavaScript activity. Employing multi-factor authentication (MFA) can reduce the impact of credential theft. Organizations should also consider behavioral AI-based email security solutions to detect and respond to sophisticated phishing campaigns. There is no vendor advisory or patch available; mitigation relies on detection and user awareness.

Summary

Bluekit phishing kit has adopted a browser-in-the-middle (BitM) attack method, leveraging the rrweb JavaScript library to serialize and stream the victim's DOM over WebSocket to the attacker. This allows the attacker to relay interactions with the legitimate login page, capturing valid session tokens and gaining unlimited access to victim accounts. Bluekit also integrates AI-assisted phishing email generation and uses multiple anti-analysis techniques including randomized CSS filters, obfuscated JavaScript, custom CAPTCHAs, browser fingerprinting, and WebRTC IP mismatch detection to evade detection and qualify victims. The platform provides live victim monitoring and supports multiple popular online services as targets.

References

bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Jun 2026, 15:16 UTC

References

Community reviews