Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via Browser-in-the-Middle (rrweb DOM Streaming) — Threadlinqs Intelligence
As of 2026-06-27, Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via Browser-in-the-Middle (rrweb DOM Streaming) is a high-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0953 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Bluekit is an all-in-one Phishing-as-a-Service (PhaaS) platform that defeats Microsoft and enterprise MFA using a Browser-in-the-Middle (BitM) technique: it loads the genuine login page inside an
Bluekit is a mature, commercialized Phishing-as-a-Service (PhaaS) platform that centralizes the full phishing lifecycle — site creation, automated domain purchase/registration, captured-credential logs, delivery tooling, and campaign support — behind a single operator panel with Telegram wired in as the default exfiltration channel. First documented by Varonis Threat Labs in spring 2026 (then assessed as still in development), the platform has since matured operationally; Netcraft confirmed approximately 70 live hostnames detected in a single week as of 25 June 2026.
Bluekit's defining capability is its shift from the adversary-in-the-middle (AitM) reverse-proxy model used by tools like Evilginx to a Browser-in-the-Middle (BitM) architecture. Rather than proxying HTTP traffic, the platform renders the legitimate target login page inside an attacker-controlled browser running on its own infrastructure, then serializes that page's live DOM and streams it to the victim over a WebSocket connection using rrweb — an open-source JavaScript library originally built for session replay and product analytics. rrweb was chosen for its visual fidelity, real-time interactivity, and bandwidth efficiency: it transmits DOM mutation events rather than pixels or video, so the victim's browser renders a pixel-perfect, fully interactive login page natively rather than as a screenshot or screen recording. Victim mouse movements and keystrokes are relayed back into the attacker's browser, where the actual authentication — username, password, and any MFA challenge (SMS OTP, authenticator TOTP, or push approval) — is completed.
Because the session is created and consumed in the same (attacker-owned) browser from start to finish, Bluekit eliminates the detection signals that plague reverse-proxy phishing: there is no later import of a stolen session cookie into a different browser, so device/browser fingerprint, IP, and TLS characteristics remain internally consistent and no anomalous-session-import alert fires. The operator ends the flow holding a valid session token and unrestricted access to the victim's account, plus repeated dumps of cookies and local storage and a live 5-second-refresh view of what the target sees after login.
The attack is delivered in two phases. Phase 1 (victim qualification / anti-analysis) gates access using randomized CSS filter manipulation on top-level HTML elements (rotating saturation, hue, brightness, and contrast values on every visit to defeat pixel-hash screenshot detection), a >1MB obfuscated JavaScript bundle that is rotated periodically, a custom CAPTCHA with randomized HTML structure sometimes styled to impersonate Cloudflare or the spoofed brand, browser fingerprinting (RAM, CPU core count, browser language, screen resolution, headless-browser indicators), and a WebRTC STUN-server check that compares the browser's reported public IP against the connection IP to flag VPN/proxy users and security researchers. Phase 2 (BitM delivery) serves the live rrweb DOM stream over WebSocket and uses a server-side proxy API endpoint to fetch page assets (images, fonts, CSS) that are not carried in the DOM stream, avoiding direct victim-to-target connections.
Beyond Microsoft/Outlook/Hotmail, Bluekit advertises 40+ phishing templates spanning email and cloud accounts, developer platforms, social media, retail, and crypto services — including iCloud, Apple ID, Gmail, Yahoo, ProtonMail, GitHub, Twitter/X, Zoho, Zara, and Ledger. Optional add-ons include an AI Assistant panel (an abliterated Llama model by default, with GPT-4.1, Claude Sonnet 4, Gemini, and DeepSeek variants exposed but largely non-functional, producing only placeholder-heavy campaign skeletons), voice cloning, and a bulk mail sender, plus geolocation emulation, spoofing, antibot cloaking, and Telegram/browser notifications. No CVE applies; this is a tradecraft/tooling threat rather than a software vulnerability.
Weaknesses (CWE)
CWE-1021, CWE-290, CWE-308, CWE-451
Target sectors: technology, financial, cryptocurrency, government, healthcare, professional services, any Microsoft 365 / Entra ID tenant
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1583, T1583, T1588, T1608, T1598, T1566, T1557, T1111, T1539, T1056