Bluekit Phishing Kit Uses Browser-in-the-Middle to Steal MFA-Protected Microsoft Sessions
The Bluekit phishing-as-a-service platform has expanded quickly and upgraded its credential-theft capability by shifting from adversary-in-the-middle methods to browser-in-the-middle attacks aimed at Microsoft logins. Netcraft identified nearly 70 live hostnames in a week and reported that Bluekit streams an attacker-controlled browser session to victims using the legitimate rrweb JavaScript library over WebSockets, letting targets interact with the real Microsoft sign-in page while attackers capture credentials and authenticated session tokens in real time.
Researchers said the approach can bypass MFA because authentication is completed inside the attacker’s browser, eliminating the browser-fingerprint mismatch often associated with reverse-proxy phishing kits such as Evilginx. Bluekit also includes anti-analysis and victim-filtering features including obfuscated JavaScript, randomized CSS filters, browser fingerprinting, WebRTC-based IP mismatch checks, fake brand-themed CAPTCHA pages, live victim monitoring, AI-assisted phishing email generation, and templates targeting major online services.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Netcraft reports Bluekit shifted to browser-in-the-middle attacks
Netcraft found that Bluekit upgraded from adversary-in-the-middle techniques to browser-in-the-middle attacks, using rrweb and WebSockets to stream an attacker-controlled browser session and steal authenticated Microsoft sessions. The reporting also notes Bluekit's anti-analysis and victim-filtering features remained active.
Netcraft identifies nearly 70 new Bluekit hostnames in one week
Netcraft reported that Bluekit expanded rapidly, with nearly 70 new hostnames identified over the past week, indicating increased operational scale of the phishing platform.
Varonis previously documented Bluekit's phishing platform features
The references state that Varonis had previously documented Bluekit as a phishing-as-a-service platform offering AI-assisted phishing email generation and dozens of templates targeting major online services.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
Bluekit Phishing Kit Uses Browser-in-the-Middle Attacks to Evade Detection
hackread.com
Open sourceNew Bluekit Phishing-as-a-Service Bypasses MFA to Steal Microsoft Login Credentials
cybersecuritynews.com
Open sourceBluekit phishing kit adopts browser-in-the-middle for login theft
bleepingcomputer.com
Open sourceBluekit Phishing-as-a-Service: Browser-in-the-Middle (BitM) Analysis
netcraft.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bluekit phishing kit bundles AI-assisted lures with 40+ brand templates
Researchers at Varonis Threat Labs identified **Bluekit**, a phishing-as-a-service kit that packages domain registration, phishing page deployment, campaign management, credential handling, and real-time victim session monitoring into a single dashboard. The platform ships with more than 40 templates impersonating major brands and services including Apple, Gmail, Outlook, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger, and it supports Telegram-based exfiltration of stolen data. Investigators said the kit is under active development and is designed to lower the barrier for less experienced cybercriminals. Bluekit also advertises an **AI Assistant** that can help generate phishing campaign drafts and lists multiple model options, including `Llama`, `GPT-4.1`, `Claude`, `Gemini`, and `DeepSeek`. Testing found the feature remains immature: only the default Llama option worked without added configuration, and its output relied on placeholders rather than producing polished, ready-to-launch lures. Even so, researchers said Bluekit includes advanced evasion and attack features such as VPN and proxy blocking, headless-browser detection, fingerprint and device filtering, geolocation tricks, spoofing, voice cloning, antibot cloaking, and claimed support for bypassing two-factor authentication, raising concern that continued development could accelerate adoption in phishing campaigns.
Jun 29, 2026
Phishing-as-a-Service 'Sneaky 2FA' Kit Enables Browser-in-the-Browser Credential Theft
Threat actors are leveraging a Phishing-as-a-Service (PhaaS) kit called **Sneaky 2FA** to deploy advanced Browser-in-the-Browser (BitB) phishing attacks. This kit allows attackers to create highly convincing fake browser pop-up windows that closely mimic legitimate sign-in prompts, including a forged address bar displaying authentic-looking URLs. The technique is designed to deceive users into entering their credentials, which are then exfiltrated to the attacker. Security researchers have observed these attacks targeting Microsoft account credentials, with the kit's obfuscated code and anti-analysis features making detection and mitigation more challenging. The Sneaky 2FA kit is available on criminal marketplaces, enabling even less-skilled threat actors to launch sophisticated phishing campaigns at scale. Attackers often use additional evasion tactics, such as bot protection checks (e.g., Cloudflare Turnstile) and CAPTCHAs, to filter out automated security tools before presenting the fake login window to real users. Experts recommend using password managers, which can help detect these fake forms by refusing to autofill credentials on non-legitimate login pages, as a key defense against such deceptive phishing techniques.
Jun 29, 2026
Starkiller Adversary-in-the-Middle Phishing Suite Bypasses MFA via Reverse Proxy
Researchers disclosed **Starkiller**, a phishing-as-a-service suite advertised by a group calling itself **Jinkusu** that uses an **adversary-in-the-middle (AiTM) reverse proxy** to bypass multi-factor authentication by relaying victims to *live* legitimate login pages while capturing credentials and session tokens for account takeover. The tooling reportedly runs a headless Chrome instance inside a **Docker** container to load the real target site and proxy traffic end-to-end, reducing the need for static phishing templates and making fingerprinting/blocklisting harder; it also provides an operator dashboard to select brands/URLs to impersonate, supports lure keyword customization (e.g., “login,” “verify,” “security,” “account”), and integrates URL shorteners (e.g., *TinyURL*) to mask destinations. Separate reporting described a targeted AiTM intrusion attempt that used multiple redirect hops and an **ASP.NET Core** reverse proxy in front of Microsoft 365 login pages, but the author could not attribute it to any known commercial kit based on published AiTM “cheat sheets,” highlighting ongoing evolution and diversification of reverse-proxy phishing stacks beyond commonly documented PHP/Node/Go/Python implementations. Other items in the set cover unrelated malware and threat activity (Android trojans, an Iraq-focused APT campaign, an APT42 PowerShell backdoor, malvertising redirect mechanics, and scam-infrastructure/supply-chain activity) and do not materially add to the Starkiller AiTM disclosure.
Jun 29, 2026