Bluekit Phishing Kit Automates Domain Setup and Session Hijacking

Researchers at Varonis discovered Bluekit, a turnkey phishing-as-a-service platform that bundles domain management, over 40 target templates (e.g., iCloud, Gmail, GitHub, Ledger), anti-bot and device filtering, Telegram-based exfiltration, and session-hijacking features that continuously dump cookies and local storage; the service also includes an AI assistant to help craft lures. While still evolving, Bluekit’s automation and session-capture capabilities make it a high-risk enabler for credential theft and account takeover campaigns.