Bluekit phishing kit puppets the victim's browser in real time

Bluekit, the phishing-as-a-service platform first documented by Varonis back in April, has picked up a fairly significant upgrade. Netcraft researchers spotted nearly 70 new Bluekit hostnames in the past week, and the kit has retired its older adversary-in-the-middle setup in favour of something called browser-in-the-middle, or BitM.

The distinction is worth slowing down for. In a classic phishing flow, the victim types credentials into a lookalike page and the kit relays them onward. In a BitM attack, the victim is interacting with an actual browser session running on the attacker's machine. That browser loads the genuine login page, and everything the victim sees, types and clicks is piped back and forth in real time. When authentication completes, the session token is already sitting on the attacker's side, with whatever multi-factor step the victim just helpfully finished.

How the trick works

Bluekit pulls this off using rrweb, an open-source JavaScript library normally used for session replay and product analytics. It serialises the page and streams it to the victim over a WebSocket. Images, fonts and CSS are fetched through the phishing infrastructure, while keystrokes and clicks travel back to the attacker's browser. Netcraft is careful to point out that rrweb itself is a perfectly legitimate tool and shouldn't be treated as an indicator of compromise on its own.

The one consistent giveaway is latency. Because every input is doing a round trip to another browser, login pages can feel a little sluggish. Small delays on typing, a slight lag on clicks, nothing dramatic but noticeable if you're paying attention.

Built to keep researchers out

Before the phishing flow even starts, Bluekit runs a fairly thorough screening layer. It fingerprints visitors, checks for WebRTC IP mismatches and filters out anything that looks like a researcher, sandbox or crawler. If you pass the door check, you get the polished fake. If you don't, you get nothing interesting to look at.

Once a victim is in the funnel, operators watch them work through it on a live dashboard that refreshes every five seconds. They can follow what the victim does after login as well, which is the whole point. The credentials matter less than the live session.

An AI assistant and 40 templates out of the box

The kit also ships with an AI assistant wired up to Llama, GPT-4.1, Claude, Gemini and DeepSeek to help operators draft lure emails. It comes with around 40 templates covering the obvious targets: Outlook, Gmail, ProtonMail, iCloud, GitHub, Ledger and the rest of the usual list.

None of this makes the underlying trick new. Browser-in-the-middle has been kicked around in research circles for a while. What's changed is the price of entry. A convincing, MFA-defeating phishing operation now comes pre-built, pre-templated and with a chatbot helping you write the bait. The bar for running this kind of campaign keeps drifting lower, and the only friction left for victims is whether they notice the page feels a bit slow.