Bluekit phishing kit adopts browser-in-the-middle for login theft

Bluekit, a phishing-as-a-service platform, has expanded its infrastructure and added browser-in-the-middle (BitM) capabilities using the rrweb library to stream DOM and relay legitimate login sessions to attackers, enabling credential theft and account takeover. The service includes AI-assisted phishing email generation, numerous templates and hostnames, live victim monitoring, and multiple anti-analysis measures (randomized CSS filters, obfuscated rotating JavaScript bundles, CAPTCHAs, browser fingerprinting, WebRTC IP mismatch checks); Netcraft and Varonis research provide detection signals though many are contextual rather than definitive IoCs.