Bluekit phishing kit bundles AI-assisted lures with 40+ brand templates

Researchers at Varonis Threat Labs identified Bluekit, a phishing-as-a-service kit that packages domain registration, phishing page deployment, campaign management, credential handling, and real-time victim session monitoring into a single dashboard. The platform ships with more than 40 templates impersonating major brands and services including Apple, Gmail, Outlook, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger, and it supports Telegram-based exfiltration of stolen data. Investigators said the kit is under active development and is designed to lower the barrier for less experienced cybercriminals.

Bluekit also advertises an AI Assistant that can help generate phishing campaign drafts and lists multiple model options, including Llama, GPT-4.1, Claude, Gemini, and DeepSeek. Testing found the feature remains immature: only the default Llama option worked without added configuration, and its output relied on placeholders rather than producing polished, ready-to-launch lures. Even so, researchers said Bluekit includes advanced evasion and attack features such as VPN and proxy blocking, headless-browser detection, fingerprint and device filtering, geolocation tricks, spoofing, voice cloning, antibot cloaking, and claimed support for bypassing two-factor authentication, raising concern that continued development could accelerate adoption in phishing campaigns.