BlueKit Phishing Kit Steals Sessions and Uses AI to Help Launch Attacks in 10 Minutes
Summary
Malwarebytes researchers detail BlueKit, a phishing-as-a-service toolkit with templates for 97 brands, SMS delivery, session and device-data theft, and an AI assistant. Operators claim attackers can set up a phishing site in about 10 minutes.
Key points
- BlueKit offers phishing templates impersonating 97 brands across 176 variants, including consumer, financial, business, and security services.
- The toolkit’s operators claim a phishing site can be deployed in about 10 minutes; the cheapest listed plan costs $250 for seven days.
- BlueKit can capture passwords, device fingerprints, session cookies, and passkeys, enabling attackers to hijack active sessions.
- A built-in SMS sender lets users send smishing messages from the dashboard; operators say it supports local US phone numbers.
- The kit includes an AI assistant advertised to help create phishing emails and text messages.
- Malwarebytes recommends using official apps or saved bookmarks, checking web addresses, using passkeys and two-factor authentication, and reviewing sessions after suspected credential exposure.
Article Details
- Attack Vectors
- BlueKit provides phishing templates impersonating consumer, financial, cryptocurrency, social media, generative AI, and business services.
- The service supports credential theft, including passwords and passkeys, and captures device fingerprints and session cookies to enable account hijacking.
- BlueKit includes an SMS sender for smishing; its operators say it can use local US phone numbers.
- The built-in AI assistant can generate phishing emails and fake text messages.
- Operators say an attacker can connect a domain and deploy a phishing site in around 10 minutes.
- Defensive Notes
- Open services through their official app or a saved bookmark rather than links in messages, and check the website address before signing in.
- Use a password manager and consider Malwarebytes Browser Guard to help identify or block phishing pages.
- Use passkeys where available and keep two-factor authentication enabled, while recognizing that some phishing techniques can capture sessions after login.
- If credentials were entered through a suspicious link, use the official app or website to change the password, review account activity, and sign out of all sessions.
- Malwarebytes Scam Guard can help assess suspicious messages.
MITRE ATT&CK
T1539 · Steal Web Session CookieBlueKit captures session cookies so attackers can use victims' active sessions to access accounts.T1556 · Modify Authentication ProcessThe article says captured device fingerprints and session information can help attackers mimic a victim's device and bypass security checks.T1566.002 · Spearphishing LinkBlueKit supplies impersonation pages and supports phishing emails and SMS messages that direct victims to malicious login pages.T1598 · Phishing for InformationThe phishing pages are designed to obtain account credentials, passkeys, and other information from victims.
Threat Actors
Products
AmazonConsumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.American ExpressFinance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges.AppleConsumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.Bank of AmericaFinance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges.BlueKitOne of the most dangerous examples of this trend is BlueKit, a phishing-as-a-service (PhaaS) toolkit designed to automate and scale account hijacking.Booking.comConsumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.Citrixdeveloper and source control environments like GitHub, and security services including Check Point, Citrix, Cloudflare, and Cisco.Cloudflareand source control environments like GitHub, and security services including Check Point, Citrix, Cloudflare, and Cisco.FacebookSocial media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.GitHubautomation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix, Cloudflare, and Cisco.GmailConsumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.GoogleConsumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple.HubSpotThis includes customer relationship and marketing automation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix,Malwarebytes Browser GuardA password manager can help as it will only autofill logins on the correct site, while Malwarebytes Browser Guard can help block phishing pages.Malwarebytes Scam GuardPro tip: Malwarebytes Scam Guard can also help you assess a suspicious message before you act on it.OpenAIGenerative AI platforms: Templates designed to steal login details for services including OpenAI and Anthropic.SalesforceThis includes customer relationship and marketing automation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix,TikTokSocial media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.TrezorBelow is a video demo of a phishing page impersonating the crypto wallet provider Trezor:XSocial media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.
Countries
Industries
communicationsSocial media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.CryptocurrencyFinance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges.financeFinance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges.Generative AIGenerative AI platforms: Templates designed to steal login details for services including OpenAI and Anthropic.Marketing automationThis includes customer relationship and marketing automation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix,Social mediaSocial media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X.Software development