Loading threat actor…
BlueKit is a commercial phishing-as-a-service platform used for large-scale credential theft, session hijacking, and account takeover. It is positioned as an actively developed phishing kit ecosystem that centralizes domain setup, phishing-page deployment, credential collection, victim monitoring, and campaign management through a SaaS-like operator model with subscription tiers, reseller support, dashboards, automation, and anti-detection tooling. BlueKit targets a broad mix of consumer and enterprise services, including email providers, cloud platforms, developer services, financial institutions, e-commerce brands, and cryptocurrency services and hardware wallets. Reported template coverage includes Microsoft, Google, Apple, Amazon, GitHub, ProtonMail, iCloud, Ledger, Trezor, and banking-themed lures. Some workflows extend beyond credential capture into post-compromise automation such as password changes, backup-code generation, passkey enrollment, session replay, and victim lockout. The platform has evolved from adversary-in-the-middle phishing toward browser-in-the-middle techniques. Reported implementations use a legitimate session-replay library to stream and relay a victim-facing browser session while authentication completes in an attacker-controlled browser, enabling theft of authenticated session tokens and subsequent account access. BlueKit has also been reported to use a peer-to-peer phishing page rendering architecture intended to conceal backend infrastructure and complicate network-based analysis, fingerprinting, and takedown efforts. BlueKit incorporates extensive defense-evasion and victim-filtering features. Reported capabilities include obfuscated and frequently changing client-side code, randomized visual manipulation to hinder screenshot-based detection, custom CAPTCHA gates, browser fingerprinting, WebRTC-based IP mismatch checks, phishing cloaking, anti-bot filtering, and monitoring for reputation or phishing-detection services. Operators can reportedly observe victims in near real time during login flows and receive notifications through messaging integrations. BlueKit is also described as AI-assisted, with support for automated phishing email drafting and campaign creation. Additional integrations reportedly support bulk smishing, CAPTCHA solving, anti-detect browsers, and automated credential post-processing. Reporting has noted possible links to CIS-aligned cybercrime ecosystems, but high-confidence attribution to a specific state sponsor is not established. BlueKit is best characterized as a financially motivated cybercriminal phishing service rather than a nation-state intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Actively developed phishing-as-a-service platform offering reverse-proxy phishing, credential and cookie collection, antibot controls, Telegram notifications, and infrastructure management features.
An AI-powered phishing kit/platform enabling automated infrastructure deployment, evasion, and AI-assisted phishing campaign creation, illustrating the rapid evolution of phishing operations.
Phishing-as-a-service operation that provides AI-assisted phishing email generation, branded credential-harvesting templates, and browser-in-the-middle capability to steal credentials and session tokens for account takeover.
Commercial phishing-as-a-service operation providing large-scale credential harvesting, adversary-in-the-middle phishing, session hijacking, account takeover, smishing, and automated post-compromise workflows against financial institutions, cloud providers, cryptocurrency platforms, e-commerce services, and enterprise accounts globally.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.