The AI-Powered Phishing Kit That’s Mostly Hype (Except for One Feature)

Bluekit is a phishing-as-a-service platform that bundles AI-generated lure templates, domain registration, anti-bot cloaking, and session-capture capabilities into a single panel; researchers observed rapid growth in hostnames and a novel "browser-in-the-middle" technique that streams an attacker-controlled browser to victims to steal session tokens. The report argues the real danger is the automation and infrastructure (reseller program, registrar integrations, template catalog) that make launching convincing phishing sites trivial, and it recommends prioritizing phishing-resistant MFA, device-compliance checks, tighter session controls, and automated domain takedowns.