Bluekit Phishing Kit Adds Browser-in-the-Middle Session Theft
Summary
Netcraft reports that Bluekit now uses rrweb to relay legitimate login pages through an attacker-controlled browser, enabling operators to capture session tokens. The kit also uses victim filtering and anti-analysis checks.
Key points
- Netcraft reports nearly 70 new Bluekit hostnames identified in the past week.
- Bluekit uses rrweb to serialize login-page DOM content and stream it over WebSockets while relaying requests and responses through an attacker-controlled browser.
- The article says operators can capture valid session tokens when authentication completes in the attacker’s browser.
- Reported anti-analysis measures include randomized CSS, frequently changing obfuscated JavaScript, CAPTCHA, browser fingerprinting, and WebRTC-based IP mismatch checks.
- Netcraft notes that rrweb is legitimate software and that its presence alone is not an indicator of compromise.
- The article describes possible detection signals, including unusual CSS manipulation, rotating obfuscated JavaScript, and encrypted or binary WebSocket traffic on login pages.
Article Details
- Event Type
- Bluekit phishing-as-a-service platform update adding browser-in-the-middle login theft and expanded anti-analysis features.
- Impact
- The platform relays legitimate login pages through an attacker-controlled browser, allowing operators to capture credentials and valid session tokens and access victims’ accounts. Victim filtering and anti-analysis checks are intended to evade researchers and security tools. Nearly 70 new hostnames were identified, but the article does not list them.