Loading threat actor…
petrushka is a financially motivated cybercrime actor operating and offering BlueKit, a subscription-based phishing-as-a-service toolkit marketed on a cybercrime forum. BlueKit provides a centralized campaign dashboard that lowers the technical barrier to credential theft and account hijacking. The actor’s geographic origin and organizational affiliations are not established. BlueKit supports phishing against consumer accounts, corporate logins, and single sign-on gateways. Its template library encompasses technology providers, financial institutions, cryptocurrency services, social networks, e-commerce platforms, and travel services. By September of its documented development period, the service advertised 97 impersonated brands across 176 template variants. Its integrated SMS sender enables customers to distribute smishing messages directly from the campaign dashboard. The toolkit captures login credentials, authenticated session cookies, and device fingerprints, including browser and device characteristics. Stolen cookies can enable account access without re-entering passwords or supplying an additional two-factor authentication code. Captured device information can support attempts to imitate legitimate users’ devices and evade device-recognition checks. BlueKit also advertises an unrestricted AI assistant for generating phishing emails and fraudulent text messages. The service is sold through time-limited subscriptions; its actual customer count and revenue are not independently established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 malware family Mallory has associated with this actor across public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.