BlueKit Phishing Service Offers Session Theft and Automated Account Takeover
Summary
CloudSek researchers analyzed BlueKit, a commercial phishing platform with 87 kits, P2P page rendering, anti-detection features, and automated account-takeover workflows targeting financial, cloud, and cryptocurrency services.
Key points
- BlueKit provides subscription-based phishing infrastructure and 87 templates targeting services across banking, cloud, social media, e-commerce, and cryptocurrency.
- Researchers found the platform uses P2P page rendering intended to obscure backend infrastructure from conventional traffic inspection and analysis.
- The platform can capture credentials, authentication tokens, and session cookies, with tools for replaying sessions and automating some post-login actions.
- Some templates support actions such as password changes, passkey enrollment, and Google Ads account administration; the researchers identified active post-authentication automation in five kits.
- BlueKit includes bulk SMS phishing, CAPTCHA and anti-bot evasion features, and templates designed to harvest hardware-wallet recovery phrases.
- The analysis describes reseller capabilities and cryptocurrency payments, and reports that the platform’s database schema includes fields for victim records, operator accounts, WebAuthn credentials, and payment data.
- CloudSek recommends phishing-resistant MFA, conditional access, stricter session controls, and user training on phishing and smishing.
Article Details
- Attack Vectors
- Phishing pages harvest credentials, authentication tokens, and session cookies; templates target financial, cloud, cryptocurrency, e-commerce, and other online services.
- Bulk SMS phishing uses spoofed sender IDs, customizable lures, and batch delivery.
- The reported adversary-in-the-middle setup intercepts active sessions and can capture session cookies during authentication.
- Hardware-wallet update templates attempt to harvest Ledger and Trezor recovery seed phrases.
- After credential capture, reported workflows can change passwords, enroll passkeys, generate backup codes, and add attacker-controlled accounts as Google Ads administrators.
- Defensive Notes
- Disable SMS-based MFA where possible and transition to phishing-resistant MFA methods.
- Use conditional access requiring device compliance and trusted-device validation for sensitive account access.
- Enforce session expiration and re-authentication for high-risk activities.
- Train users to recognize phishing, smishing, fake CAPTCHA lures, and passkey-related social engineering.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bluekit[.]cc | Listed as a BlueKit clearnet infrastructure domain. |
| DOMAIN | bluekit[.]pk | Listed as a BlueKit clearnet infrastructure domain. |
| DOMAIN | bluekit[.]su | Listed as a BlueKit clearnet infrastructure domain. |
| DOMAIN | bluekit[.]ws | Listed as a BlueKit clearnet infrastructure domain. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing pages capture credentials entered by victims.T1098 · Account ManipulationReported post-compromise workflows enroll attacker-controlled authentication mechanisms and can add attacker-controlled accounts as Google Ads administrators.T1539 · Steal Web Session CookieBlueKit is reported to capture victims’ session cookies.T1550.004 · Web Session CookieCaptured session cookies can be imported into Octo Browser and replayed to access authenticated sessions.T1557.001 · Name Resolution Poisoning and SMB RelayThe article describes an adversary-in-the-middle setup that intercepts active sessions.T1566 · PhishingBlueKit provides phishing kits and infrastructure for credential-harvesting campaigns.
Vendors
Products
Amazon AWSAmazon AWSBlueKitanalyzed an actively operated commercial Phishing-as-a-Service (PhaaS) platform operating under the name BlueKit. Our investigation determined that BlueKit provides a complete phishing infrastructure designed to enableGmailgmailGoogle AdsAdds attacker as Google Ads account administratorLedgerLedger UpdateMicrosoft LiveMicrosoft Live SecurityTrezorTrezor Update
Tools
Countries
Industries
Cloud and enterprise servicesCryptocurrencysession hijacking, and account takeover campaigns targeting financial institutions, cloud providers, cryptocurrency platforms, and major e-commerce services globally.E-commercecampaigns targeting financial institutions, cloud providers, cryptocurrency platforms, and major e-commerce services globally.Financial ServicesBanking & Financial Services (17 Kits)