Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
One of the most dangerous examples of this trend is BlueKit, a phishing-as-a-service (PhaaS) toolkit designed to automate and scale account hijacking.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Bluekit is a newly discovered phishing kit still in development that includes advanced features such as an AI assistant and automated domain registration.
Top 10 Phishing Kits and Platforms
“40+ ready-made phishing templates,” “Rapid template deployment,” and “mail sender.”
“2FA interception with device and geolocation spoofing” and “1:1 templates and 2FA bypass.”
Bluekit subjects every visitor to layered anti-analysis checks, including... obfuscated JavaScript bundles exceeding 1MB that are periodically rotated...
The kit advertises over 40 website templates... spoofing, geolocation emulation, Telegram notifications, antibot cloaking...
Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.
It looks at computer details like RAM, screen size, and browser language.
“Additional tooling such as AI assistant, VM checker, voice cloning, and mail sender.”
GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.
“Capture of cookies, local storage, and keystrokes.”
Traditional MFA, including SMS codes, authenticator apps, and push approvals, provides no protection against Bluekit’s architecture. Since the victim completes the entire login flow, including MFA verification, inside the attacker’s browser, the attacker inherits a fully authenticated session from the start.
The platform relayed victims’ credentials and MFA responses to legitimate login services before capturing authenticated session cookies.
Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.
Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.
It looks at computer details like RAM, screen size, and browser language.
“Additional tooling such as AI assistant, VM checker, voice cloning, and mail sender.”
“2FA interception with device and geolocation spoofing” and “Capture of cookies, local storage, and keystrokes.”
GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.
“Capture of cookies, local storage, and keystrokes.”
Capturing authenticated session material can provide account access even after a victim completes a conventional MFA challenge.
Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.
An open-source software tool called rrweb then “records and streams live DOM interactions” to the victim over a WebSocket connection.
Using WebRTC technology, it connects to a STUN server to check a user’s web settings. Now, the hackers can see if a visitor is using a proxy or a VPN to hide their identity.
Stolen data is exfiltrated via Telegram, on private channels accessible by the operators.
The Telegram integration is set as the default exfiltration channel, meaning stolen credentials and session tokens are sent directly to an attacker-controlled chat in real time.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.