Bluekit phishing kit adopts browser-in-the-middle for login theft

Bluekit, a phishing‑as‑a‑service platform, has added browser‑in‑the‑middle (BitM) capabilities to its kit, allowing attackers to intercept and relay user interactions with legitimate login pages. The new BitM mechanism uses the open‑source JavaScript library rrweb to serialize the page’s DOM and stream it over a WebSocket to the attacker’s browser, which then relays requests and responses between the victim and the target service. Bluekit supports multiple large‑language models—including Llama, GPT‑4.1, Claude, Gemini, and DeepSeek—to draft phishing emails, and previously offered 40 templates targeting services such as Outlook, Gmail, Yahoo, and GitHub. The platform now includes anti‑analysis features such as randomized CSS filters, a large obfuscated JavaScript bundle, custom CAPTCHA, browser fingerprinting, and WebRTC‑based IP mismatch detection. A live monitoring system with a 5‑second update interval lets operators track victims’ actions after login. The BitM attack method, first documented in 2022, is known for its visual fidelity and real‑time interactivity, but still introduces latency that can be detected by careful observation. Indicators of compromise include CSS filter manipulation, obfuscated JS bundle rotation, browser fingerprint checks, encrypted WebSocket traffic on login pages, and WebRTC IP mismatch detection. The platform’s evolution demonstrates how phishing services are increasingly leveraging advanced techniques to evade detection and increase credential theft.