An active BlueKit BitM phishing campaign targeting financial-sector CEOs: branded PDF lures, geofencing, M365 session hijack, and ScreenConnect delivery.

This roundup shows how attackers are using normal-looking actions like Teams chats, file-sharing prompts, trusted software, and OAuth consent to gain access without obvious alarms. It also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy,...

A new phishing-as-a-service (PHaaS) platform called Bluekit is letting cybercriminals steal user accounts using a tricky method. While…

Bluekit phishing kit is active at scale, using browser-in-the-middle attacks, bot checks, and fake CAPTCHAs to steal logins while dodging security scans.

Bluekit phishing kit is active at scale, using browser-in-the-middle attacks, bot checks, and fake CAPTCHAs to steal logins while dodging security scans.

A new phishing-as-a-service (PHaaS) platform called Bluekit is letting cybercriminals steal user accounts using a tricky method. While…

A new phishing-as-a-service (PHaaS) platform called Bluekit is letting cybercriminals steal user accounts using a tricky method. While…

Bluekit フィッシング・アズ・ア・サービス プラットフォームが進化を続けており、過去1週間で約70の新規ホスト名が確認されました。ブラウザ中間層機能を追加し、ログイン認証情報の盗聴能力を強化しています。

FBI warnt vor Kali365-Plattform, die MFA umgeht. Auch Bluekit und Lazarus-Gruppe entwickeln neue Angriffsmethoden auf Microsoft 365.

A sophisticated Phishing-as-a-Service (PhaaS) platform called Bluekit has been confirmed operational at scale, with cybersecurity firm Netcraft detecting approximately 70 live hostnames in a single we...

A sophisticated Phishing-as-a-Service (PhaaS) platform called Bluekit has been confirmed operational at scale, with cybersecurity firm Netcraft detecting approximately 70 live hostnames in a single week.

Daily Recap, AI-native security, agentic workflows, and AI-abusing malware were prominent as Nebulock raised $25 million, the MCP spec expanded enterprise use while introducing new risks, and a new macOS malware strain hid fake errors to confuse AI analysis tools. Separately, Robinhood improved access-approval speed for high-velocity development while Polish authorities disrupted a SIM-swapping crypto-theft gang and attackers leveraged Bluekit, browser-in-the-middle phishing, and callback scams to target credentials. #Nebulock #MCP #macOSMalware #Robinhood #PhilipMartin #Uber #Akrites #PolandSIMSwapping #Bluekit #SIMSwapping #Cellebrite #FCC #Windows10ESU #ChromeAddOn #ShopOrderTrackingApp #PirloTV #TataElectronics #Snyk

The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft.

The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft. [...]

A sophisticated Phishing-as-a-Service (PhaaS) platform called Bluekit has been confirmed operational at scale, with cybersecurity firm Netcraft detecting approximately 70 live hostnames in a single week. First documented by Varonis Threat Labs as an emerging tool still in development, Bluekit has since matured into a fully operational threat capable of bypassing multi-factor authentication (MFA) and harvesting Microsoft login credentials in real time. Unlike conventional adversary-in-the-middle (AitM) tools such as Evilginx, which intercept web traffic passing between the victim and the legitimate site, Bluekit employs a Browser-in-the-Middle (BitM) technique . The platform loads the legitimate Microsoft login page inside an attacker-controlled browser and streams what the victim sees directly to their screen using rrweb, an open-source JavaScript library originally designed for session replay and product analytics. The result is technically significant: victims are not interacting with a cloned or proxied version of a login page. They are interacting with the actual login page, rendered in the attacker’s browser. When they complete authentication, they have logged into the attacker’s active session not their own. This architecture also neutralizes Device Bound Session Credentials (DBSC), a protection that offers some resistance to traditional AITM attacks. Bluekit Attack Architecture Bluekit operates in two distinct phases before credentials are ever captured. Phase 1 — Victim Qualification: Before showing any phishing content, Bluekit subjects every visitor to layered anti-analysis checks, including randomized CSS filter manipulation to defeat pixel-hash screenshot detection, a custom CAPTCHA that impersonates brands like Cloudflare, obfuscated JavaScript bundles exceeding 1MB that are periodically rotated, browser fingerprinting (RAM, CPU count, screen resolution, headless browser indicators), and WebRTC-based IP mismatch detection to identify security analysts and automated scanners. Attack Architecture Phase 2 — BitM Delivery: Visitors who pass qualification checks are served a live DOM stream from the attacker’s browser over a WebSocket connection, rendering a pixel-perfect, fully interactive Microsoft login page. The victim’s keystrokes and mouse movements are relayed back to the attacker’s browser, which executes them against the real Microsoft site, completing authentication on the attacker’s machine. Bluekit’s administration panel provides operators with a live view of victim sessions, powered by the same rrweb infrastructure used for delivery, Netcraft told Cybersecurity News . Threat actor demonstrations shared on Telegram show real-time visibility into victim login flows as they occur, including post-authentication activity. A key structural advantage over tools like Evilginx is session consistency. In reverse-proxy AitM attacks, the stolen session is later imported into a different browser environment, creating a fingerprint mismatch that detection systems can flag. With Bluekit, the session is created and used in the same browser throughout, eliminating that detection signal entirely. Traditional MFA, including SMS codes, authenticator apps, and push approvals, provides no protection against Bluekit’s architecture. Since the victim completes the entire login flow, including MFA verification, inside the attacker’s browser, the attacker inherits a fully authenticated session from the start. This is a critical structural advantage over tools like Evilginx, where Evilginx steals and later replays a session cookie in a different browser (creating a detectable fingerprint mismatch), Bluekit’s session is both created and used in the same browser environment, eliminating that detection signal. Security teams should monitor for the following signals in web environments: WebSocket connections transmitting encrypted or binary data on login pages (rrweb DOM stream) Proxy API endpoints handling asset fetching instead of direct requests to the legitimate site rrweb library presence outside known analytics contexts Custom CAPTCHAs not served by Google or Cloudflare with randomized HTML structures JavaScript bundles exceeding 1MB with obfuscation and periodic rotation WebRTC IP mismatch detection behavior on landing pages Security analysts running automated phishing kit evaluations should also ensure their browser environments route both TCP and UDP through proxies to avoid inadvertent IP exposure via WebRTC’s STUN server queries. Bluekit’s weaponization of rrweb, a legitimate, widely-used open-source project, follows an established threat actor pattern of abusing trusted developer infrastructure to gain legitimacy and bypass reputation-based controls. The presence of rrweb alone is not an indicator of compromise; context and surrounding signals are required for accurate attribution. Organizations relying solely on MFA as a credential-theft countermeasure should treat Bluekit as evidence that session-level protections and behavioral detection are now essential components of a complete phishing defense strategy. What Features Should AI SOC Have? – Download Free 2026 AI SOC Features Checklist The post New Bluekit Phishing-as-a-Service Bypasses MFA to Steal Microsoft Login Credentials appeared first on Cyber Security News .