Bluekit PhaaS Uses Browser-in-the-Middle Attacks to Steal Microsoft Logins

**Executive summary:** Bluekit is an actively deployed Phishing‑as‑a‑Service platform leveraging a Browser‑in‑the‑Middle (BitM) attack—using rrweb to stream a live attacker-controlled Microsoft login DOM to victims—to capture credentials and bypass MFA; the report details its two-phase flow (bot/analyst detection then BitM delivery), observable signals (WebSocket DOM streams, rrweb presence, proxy asset endpoints, WebRTC IP mismatch, custom CAPTCHA), and defensive notes including increased latency as a detection cue and recommendation to adopt phishing‑resistant authentication.