Malware

Bluekit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

Bluekit is a newly discovered phishing kit still in development that includes advanced features such as an AI assistant and automated domain registration.

Initial Access

2 techniques

T1566PhishingEvidence9

Top 10 Phishing Kits and Platforms

T1566.003Spearphishing via ServiceEvidence2

The researchers tested the assistant with a phishing scenario targeting a Microsoft 365 MFA reset for a company executive, including QR-based lures and credential-harvesting pages.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Bluekit subjects every visitor to layered anti-analysis checks, including... obfuscated JavaScript bundles exceeding 1MB that are periodically rotated...

T1036MasqueradingEvidence1

The kit advertises over 40 website templates... spoofing, geolocation emulation, Telegram notifications, antibot cloaking...

T1497Virtualization/Sandbox EvasionEvidence8

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.

T1497.001System ChecksEvidence2

It looks at computer details like RAM, screen size, and browser language.

Credential Access

4 techniques

T1056Input CaptureEvidence3

GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.

T1111Multi-Factor Authentication InterceptionEvidence2

Traditional MFA, including SMS codes, authenticator apps, and push approvals, provides no protection against Bluekit’s architecture. Since the victim completes the entire login flow, including MFA verification, inside the attacker’s browser, the attacker inherits a fully authenticated session from the start.

T1539Steal Web Session CookieEvidence7

The platform relayed victims’ credentials and MFA responses to legitimate login services before capturing authenticated session cookies.

T1557Adversary-in-the-MiddleEvidence5

Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence8

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.

T1497.001System ChecksEvidence2

It looks at computer details like RAM, screen size, and browser language.

Collection

3 techniques

T1056Input CaptureEvidence3

GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.

T1185Browser Session HijackingEvidence1

Capturing authenticated session material can provide account access even after a victim completes a conventional MFA challenge.

T1557Adversary-in-the-MiddleEvidence5

Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

An open-source software tool called rrweb then “records and streams live DOM interactions” to the victim over a WebSocket connection.

T1090ProxyEvidence1

Using WebRTC technology, it connects to a STUN server to check a user’s web settings. Now, the hackers can see if a visitor is using a proxy or a VPN to hide their identity.

Exfiltration

2 techniques

T1048Exfiltration Over Alternative ProtocolEvidence1

Stolen data is exfiltrated via Telegram, on private channels accessible by the operators.

T1567Exfiltration Over Web ServiceEvidence1

The Telegram integration is set as the default exfiltration channel, meaning stolen credentials and session tokens are sent directly to an attacker-controlled chat in real time.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

domain●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

Jul 22, 2026

Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits

Mentioned only as a prior example of AI-powered malicious tooling previously uncovered by Varonis.

varonis blogNews

Jul 22, 2026

Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI

Mentioned only as another example of AI being integrated into cybercrime tooling.

scworldNews

Jul 14, 2026

Your phishing defense was built for 2016, but attackers are operating in 2026 | perspective | SC Media

An AI-powered phishing kit that automates infrastructure deployment, includes evasion features, and assists operators in creating phishing campaigns at scale.

cyber security newsNews

May 4, 2026

Bluekit Phishing Kit Automates Domains, 2FA Lures, and Session Hijacking in One Panel

Bluekit is a phishing kit that centralizes phishing page creation, domain registration, credential harvesting, session hijacking, cookie and local storage capture, Telegram-based exfiltration, antibot cloaking, spoofing, geolocation emulation, and optional add-ons such as voice cloning and mail sending. It is designed to capture session tokens after login, allowing attackers to bypass standard 2FA protections.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Bluekit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

Bluekit is a newly discovered phishing kit still in development that includes advanced features such as an AI assistant and automated domain registration.

Initial Access

2 techniques

T1566PhishingEvidence9

Top 10 Phishing Kits and Platforms

T1566.003Spearphishing via ServiceEvidence2

The researchers tested the assistant with a phishing scenario targeting a Microsoft 365 MFA reset for a company executive, including QR-based lures and credential-harvesting pages.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Bluekit subjects every visitor to layered anti-analysis checks, including... obfuscated JavaScript bundles exceeding 1MB that are periodically rotated...

T1036MasqueradingEvidence1

The kit advertises over 40 website templates... spoofing, geolocation emulation, Telegram notifications, antibot cloaking...

T1497Virtualization/Sandbox EvasionEvidence8

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.

T1497.001System ChecksEvidence2

It looks at computer details like RAM, screen size, and browser language.

Credential Access

4 techniques

T1056Input CaptureEvidence3

GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.

T1111Multi-Factor Authentication InterceptionEvidence2

T1539Steal Web Session CookieEvidence7

The platform relayed victims’ credentials and MFA responses to legitimate login services before capturing authenticated session cookies.

T1557Adversary-in-the-MiddleEvidence5

Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence8

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.

T1497.001System ChecksEvidence2

It looks at computer details like RAM, screen size, and browser language.

Collection

3 techniques

T1056Input CaptureEvidence3

GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.

T1185Browser Session HijackingEvidence1

Capturing authenticated session material can provide account access even after a victim completes a conventional MFA challenge.

T1557Adversary-in-the-MiddleEvidence5

Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

An open-source software tool called rrweb then “records and streams live DOM interactions” to the victim over a WebSocket connection.

T1090ProxyEvidence1

Using WebRTC technology, it connects to a STUN server to check a user’s web settings. Now, the hackers can see if a visitor is using a proxy or a VPN to hide their identity.

Exfiltration

2 techniques

T1048Exfiltration Over Alternative ProtocolEvidence1

Stolen data is exfiltrated via Telegram, on private channels accessible by the operators.

T1567Exfiltration Over Web ServiceEvidence1

The Telegram integration is set as the default exfiltration channel, meaning stolen credentials and session tokens are sent directly to an attacker-controlled chat in real time.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

domain●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

Jul 22, 2026

Sneaky Windows stealer targets 300+ apps, gives crims an AI profiler to maximize profits

Mentioned only as a prior example of AI-powered malicious tooling previously uncovered by Varonis.

varonis blogNews

Jul 22, 2026

Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI

Mentioned only as another example of AI being integrated into cybercrime tooling.

scworldNews

Jul 14, 2026

Your phishing defense was built for 2016, but attackers are operating in 2026 | perspective | SC Media

An AI-powered phishing kit that automates infrastructure deployment, includes evasion features, and assists operators in creating phishing campaigns at scale.

cyber security newsNews

May 4, 2026

Bluekit Phishing Kit Automates Domains, 2FA Lures, and Session Hijacking in One Panel

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.