Bluekit phishing kit adds browser-in-the-middle to steal login data

Intelligence Summary

Bluekit, a phishing-as-a-service platform, has upgraded its credential theft workflow. The kit now uses browser-in-the-middle techniques to intercept logins more effectively. Victims who enter credentials into compromised pages may have session data and other details captured in transit. The operator has also increased operational infrastructure by adding dozens of new hostnames. Users should avoid entering credentials on suspicious pages and verify links before login.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics