Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via Browser-in-the-Middle (rrweb DOM Streaming)
Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via (TL-2026-0953), also tracked as Bluekit, is a high-severity phishing campaign, first published 2026-06-27. It has no confirmed attribution, affects Microsoft Microsoft Entra ID / Microsoft 365 / Outlook / Hotmail, maps to 19 MITRE ATT&CK techniques (T1027, T1036, T1056), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0953
- Threat ID
- TL-2026-0953
- Also known as
- Bluekit, Bluekit PhaaS, Bluekit phishing kit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-27
- Last reviewed
- 2026-06-27
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, cryptocurrency, government, healthcare, professional services, any Microsoft 365 / Entra ID tenant
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
Malware and tooling: Bluekit PhaaS kit, Bluekit, Browser-in-the-Middle (BitM) DOM-streaming server, rrweb
Bluekit is an all-in-one Phishing-as-a-Service (PhaaS) platform that defeats Microsoft and enterprise MFA using a Browser-in-the-Middle (BitM) technique: it loads the genuine login page inside an attacker-controlled headless browser and streams the live DOM to the victim over a WebSocket using the open-source rrweb session-replay library. Because the victim completes the entire authentication flow — including MFA — inside the attacker's browser, the operator inherits a fully authenticated session with no fingerprint-mismatch detection signal. Netcraft confirmed roughly 70 live hostnames in a single week.
How Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via works
Bluekit is a mature, commercialized Phishing-as-a-Service (PhaaS) platform that centralizes the full phishing lifecycle — site creation, automated domain purchase/registration, captured-credential logs, delivery tooling, and campaign support — behind a single operator panel with Telegram wired in as the default exfiltration channel. First documented by Varonis Threat Labs in spring 2026 (then assessed as still in development), the platform has since matured operationally; Netcraft confirmed approximately 70 live hostnames detected in a single week as of 25 June 2026.
Bluekit's defining capability is its shift from the adversary-in-the-middle (AitM) reverse-proxy model used by tools like Evilginx to a Browser-in-the-Middle (BitM) architecture. Rather than proxying HTTP traffic, the platform renders the legitimate target login page inside an attacker-controlled browser running on its own infrastructure, then serializes that page's live DOM and streams it to the victim over a WebSocket connection using rrweb — an open-source JavaScript library originally built for session replay and product analytics. rrweb was chosen for its visual fidelity, real-time interactivity, and bandwidth efficiency: it transmits DOM mutation events rather than pixels or video, so the victim's browser renders a pixel-perfect, fully interactive login page natively rather than as a screenshot or screen recording. Victim mouse movements and keystrokes are relayed back into the attacker's browser, where the actual authentication — username, password, and any MFA challenge (SMS OTP, authenticator TOTP, or push approval) — is completed.
Because the session is created and consumed in the same (attacker-owned) browser from start to finish, Bluekit eliminates the detection signals that plague reverse-proxy phishing: there is no later import of a stolen session cookie into a different browser, so device/browser fingerprint, IP, and TLS characteristics remain internally consistent and no anomalous-session-import alert fires. The operator ends the flow holding a valid session token and unrestricted access to the victim's account, plus repeated dumps of cookies and local storage and a live 5-second-refresh view of what the target sees after login.
The attack is delivered in two phases. Phase 1 (victim qualification / anti-analysis) gates access using randomized CSS filter manipulation on top-level HTML elements (rotating saturation, hue, brightness, and contrast values on every visit to defeat pixel-hash screenshot detection), a >1MB obfuscated JavaScript bundle that is rotated periodically, a custom CAPTCHA with randomized HTML structure sometimes styled to impersonate Cloudflare or the spoofed brand, browser fingerprinting (RAM, CPU core count, browser language, screen resolution, headless-browser indicators), and a WebRTC STUN-server check that compares the browser's reported public IP against the connection IP to flag VPN/proxy users and security researchers. Phase 2 (BitM delivery) serves the live rrweb DOM stream over WebSocket and uses a server-side proxy API endpoint to fetch page assets (images, fonts, CSS) that are not carried in the DOM stream, avoiding direct victim-to-target connections.
Beyond Microsoft/Outlook/Hotmail, Bluekit advertises 40+ phishing templates spanning email and cloud accounts, developer platforms, social media, retail, and crypto services — including iCloud, Apple ID, Gmail, Yahoo, ProtonMail, GitHub, Twitter/X, Zoho, Zara, and Ledger. Optional add-ons include an AI Assistant panel (an abliterated Llama model by default, with GPT-4.1, Claude Sonnet 4, Gemini, and DeepSeek variants exposed but largely non-functional, producing only placeholder-heavy campaign skeletons), voice cloning, and a bulk mail sender, plus geolocation emulation, spoofing, antibot cloaking, and Telegram/browser notifications. No CVE applies; this is a tradecraft/tooling threat rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-0953
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Collection
T1056 Input Capture; T1185 Browser Session Hijacking
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Discovery
T1082 System Information Discovery; T1614 System Location Discovery
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
T1598 Phishing for Information
stealth
Affected products and versions in Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
- Microsoft — Microsoft Entra ID / Microsoft 365 / Outlook / Hotmail accounts
Vulnerable versions: accounts protected by SMS OTP, authenticator TOTP, or push-approval MFA
Fixed in: accounts using phishing-resistant FIDO2/WebAuthn passkeys - Multiple — 40+ spoofed brands (Gmail, iCloud/Apple ID, Yahoo, ProtonMail, GitHub, Twitter/X, Zoho, Zara, Ledger)
Vulnerable versions: accounts using non-phishing-resistant MFA
Fixed in: accounts using FIDO2/WebAuthn passkeys
Remediation for Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
Immediate actions
- Enforce phishing-resistant FIDO2/WebAuthn passkeys for Microsoft Entra ID / Microsoft 365 and other high-value accounts; hardware-bound credentials defeat BitM because they cannot be completed inside the attacker's browser against the attacker's origin
- Block newly registered and low-reputation domains at the secure web gateway and email gateway; Bluekit automates bulk domain purchase/registration so freshness is a strong signal
- Hunt proxy logs for WebSocket connections carrying encrypted/binary data on or adjacent to login pages, and for rrweb library references outside known analytics contexts
Workarounds
- Restrict Microsoft 365 sign-ins to managed devices and named locations via Conditional Access
- Block STUN/WebRTC egress from corporate browsers where feasible to break Phase-1 victim qualification
- Alert on impossible-travel and new-device sign-ins despite valid MFA
Longer-term hardening
- Deploy Conditional Access with device compliance and managed-device requirements so sessions established outside managed devices are blocked even when MFA succeeds
- Adopt continuous access evaluation (CAE) and token-binding so authenticated sessions are tied to device posture and revoked on anomaly
- Deploy browser-isolation / DOM-anomaly detection and user training that emphasizes domain verification over visual appearance (BitM pages are pixel-perfect)
Weaknesses (CWE) in Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
CWE-1021, CWE-290, CWE-308, CWE-451
Timeline of Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
- Varonis Threat Labs publicly documents Bluekit as an AI-powered all-in-one phishing kit, assessing it as still in development; features include 40+ templates, automated domain registration, AitM session-cookie theft, an AI Assistant panel, voice cloning, and a bulk mail sender.
- Reporting on the Varonis analysis notes Bluekit's advertised AI Assistant is largely non-functional in practice — the non-default GPT-4.1/Claude Sonnet 4/Gemini/DeepSeek options produce placeholder-heavy campaign skeletons — indicating the kit's AI capability was at the time more marketing than operational.
- Security Affairs and other outlets amplify the Varonis findings, detailing the AI Assistant model options (abliterated Llama default, plus GPT-4.1, Claude Sonnet 4, Gemini, DeepSeek variants) and Telegram-based exfiltration.
- Start of the one-week observation window during which Netcraft tracked Bluekit hostnames going live at scale (approx. 70 new hostnames in the period ending 25 June 2026).
- Netcraft confirms Bluekit is operational at scale, detecting approximately 70 live hostnames in a single week, and publishes analysis of its Browser-in-the-Middle (BitM) rrweb DOM-streaming architecture.
- TechRadar and CyberPress detail Bluekit's emulation of 40+ global brands (Microsoft/Outlook, Gmail, iCloud/Apple ID, Yahoo, ProtonMail, GitHub, Twitter/X, Zoho, Zara, Ledger) and its enterprise-2FA bypass, alongside paid add-ons (AI Assistant, voice cloning, bulk mail sender, geolocation emulation, antibot cloaking).
- Public reporting describes victims completing the full login flow — including MFA — inside the attacker's browser, handing operators a valid session token and live 5-second-refresh post-login monitoring.
- BleepingComputer, Cyber Security News, TechRadar and others report Bluekit's adoption of the Browser-in-the-Middle technique that streams the live DOM over WebSocket to bypass Microsoft and enterprise MFA without fingerprint-mismatch detection.
- Threadlinqs Intelligence opens tracked threat record TL-2026-0953 for Bluekit PhaaS and maps its BitM tradecraft to MITRE ATT&CK.
Sources cited for Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
- New Bluekit Phishing-as-a-Service Bypasses MFA to Steal Microsoft Login Credentials
- Bluekit Phishing-as-a-Service: Browser-in-the-Middle (BitM) Analysis
- Bluekit phishing kit adopts browser-in-the-middle for login theft
- Meet Bluekit: The AI-Powered All-in-One Phishing Kit
- Bluekit phishing kit enables automated phishing with 40+ templates and AI tools
- Researchers discover new all-in-one 'Bluekit' phishing kit capable of bypassing enterprise 2FA and emulating 40+ global brands
- Bluekit PhaaS Uses Browser-in-the-Middle Attacks to Steal Microsoft Logins
- MITRE ATT&CK T1185 — Browser Session Hijacking
Threats related to Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via
- input_24 AiTM Phishing Kit Harvesting AWS Console Credentials and Real-Time MFA Codes
- AI-Assisted Phishing Campaign Exploits Browser Permissions via edgeone.app Infrastructure to Capture Biometric Data
- The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access
Detection coverage for TL-2026-0953
As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0953 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.