# BlueKit Phishing-as-a-Service Adds ZeroBot Bot-Screening and ScreenConnect Delivery to Target Financial-Sector CEOs via Browser-in-the-Middle

> BlueKit, a subscription phishing-as-a-service (PhaaS) platform first documented in 2024, has added a ZeroBot bot-screening gate and legitimate-ScreenConnect delivery to a campaign specifically targeting CEOs at financial-industry firms with document-sharing lures. The platform uses browser-in-the-middle (BitM) session streaming (via the rrweb library over WebSocket) to capture credentials and post-MFA session tokens, then moves selected high-value victims into a fake document-viewer that installs a legitimate ConnectWise ScreenConnect client pointed at an attacker-controlled instance.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2315
- **ID:** TL-2026-2315
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BlueKit (also styled Bluekit) is a commodity phishing-as-a-service kit that has been tracked by multiple independent research teams since April 2026, with roots reported back to April 2024. Its subscription model ($250/7 days, $480/14 days, $940/30 days, crypto-only payment) bundles 80-87 ready-made phishing templates spanning email/cloud providers (Gmail, Outlook, Yahoo, iCloud, ProtonMail), developer platforms (GitHub, Zoho), social media, banking, cryptocurrency exchanges, hardware wallets (Ledger, Trezor), and e-commerce brands, alongside automated domain registration, antibot/cloaking, and Telegram-based credential delivery.

On 2026-09-03, ZeroBEC (an Israeli threat-research startup) disclosed a variant of the platform used in an active campaign against CEOs of financial-sector companies. The chain begins with a document-sharing lure email. Before any phishing content is served, a bot-screening component the researchers named ZeroBot filters out automated scanners and security tooling, consistent with BlueKit's previously documented pre-engagement evasion phase (headless-browser fingerprinting, WebRTC IP-mismatch detection, custom CAPTCHA, randomized/obfuscated HTML and JavaScript). Victims who pass the screen are routed into a browser-in-the-middle flow: BlueKit's infrastructure opens the real target login page inside an attacker-controlled browser and streams the live DOM to the victim's browser using the open-source session-replay library rrweb over a WebSocket connection. The victim enters credentials and completes MFA against what appears to be the legitimate site, but the resulting authenticated session is created and retained on the attacker's machine, defeating standard MFA. For selected high-value victims, the operators then pivot out of the BitM flow into a fake document-viewer page that delivers a legitimate ConnectWise ScreenConnect client pre-configured to connect to an attacker-controlled ScreenConnect instance, giving the operators durable, tool-legitimate remote access to the victim's endpoint post-compromise.

This targeting and delivery pattern mirrors ZeroBEC's separately tracked Operation BlueDash (disclosed 2026-07-27), a Microsoft Teams/Zoom-themed "document too large to send" lure that used a fake Microsoft Store page (teamvem[.]com) to deliver an Inno Setup loader (supportdev.exe) enrolling victims into Level RMM, ScreenConnect, and Tactical RMM in parallel for redundant access; ZeroBEC assessed that operation to a Nigeria-based actor with moderate-to-high confidence based on infrastructure and GitHub evidence dating to February 2026. BlueKit itself shows CIS-aligned operational indicators (Jabber/XMPP preference, explicit CIS-country exclusion in its targeting logic) per CloudSEK's June 2026 analysis of an exposed BlueKit backend database, which recovered 29 database tables including a victim-credential store ("Mammoths"), WebAuthn credential captures, cryptocurrency payment/deposit records, and a reseller/distributor program with API-key access — evidence of a professional, SaaS-style crimeware operation rather than a single actor.

The same 2026-09-03 bulletin from The Hacker News also reported a separate, unrelated verified compromise: Dropbox disclosed that approximately 5,000 accounts were accessed without authorization between 2026-08-04 and 2026-08-21 because of a flaw in Lenovo's ID email-verification process. Attackers were able to register new Lenovo IDs using victims' email addresses and then use those Lenovo IDs to sign into Dropbox accounts linked via the legacy Lenovo ID integration, bypassing the victim's Dropbox password entirely on accounts that did not have Dropbox two-factor authentication enabled. Dropbox terminated all Lenovo-ID-authenticated sessions, severed the Lenovo ID/Dropbox account linkage, changed the login flow to require a Dropbox password even via Lenovo ID, and reported the incident to data-protection regulators.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1082 System Information Discovery
- T1185 Browser Session Hijacking
- T1219 Remote Access Tools
- T1071 Application Layer Protocol

## Sources

- [ThreatsDay Bulletin: CEO Phishing Kits, 5K Dropbox Accounts Hacked, and More](https://thehackernews.com/2026/09/threatsday-ceo-phishing-kits-5k-dropbox.html)
- [BlueKit PhaaS: Browser-in-the-Middle and ScreenConnect Delivery Targets Financial-Sector CEOs](https://zerobec.com/blog/bluekit-phaas-browser-in-the-middle-screenconnect)
- [Bluekit Phishing-as-a-Service: Browser-in-the-Middle (BitM) Analysis](https://www.netcraft.com/blog/bluekit-phishing-as-a-service-threat)
- [Bluekit phishing kit adopts browser-in-the-middle for login theft](https://www.bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/)
- [Bluekit Phishing as a Service (PhaaS)](https://www.cloudsek.com/blog/bluekit-phishing-as-a-service-phaas)
- [Meet Bluekit: The AI-Powered All-in-One Phishing Kit](https://www.varonis.com/blog/bluekit)
- [Bluekit Phishing Kit Automates Domains, 2FA Lures, and Session Hijacking](https://cybersecuritynews.com/bluekit-phishing-kit-automates-domains/)
- [Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update](https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html)
- [Operation BlueDash: Multi-RMM Workplace Phishing](https://zerobec.com/blog/operation-bluedash-multi-rmm-workplace-phishing)
- [Dropbox says about 5,000 accounts compromised in August hack](https://www.reuters.com/technology/dropbox-says-about-5000-accounts-compromised-august-hack-2026-09-02/)
- [Legacy Lenovo login opens 5,000 Dropbox accounts to attackers](https://www.theregister.com/security/2026/09/02/legacy-lenovo-login-opens-5000-dropbox-accounts-to-attackers/5293924)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2315