Loading story…
Researchers at Varonis Threat Labs identified Bluekit, a phishing-as-a-service kit that packages domain registration, phishing page deployment, campaign management, credential handling, and real-time victim session monitoring into a single dashboard. The platform ships with more than 40 templates impersonating major brands and services including Apple, Gmail, Outlook, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger, and it supports Telegram-based exfiltration of stolen data. Investigators said the kit is under active development and is designed to lower the barrier for less experienced cybercriminals.
Bluekit also advertises an AI Assistant that can help generate phishing campaign drafts and lists multiple model options, including Llama, GPT-4.1, Claude, Gemini, and DeepSeek. Testing found the feature remains immature: only the default Llama option worked without added configuration, and its output relied on placeholders rather than producing polished, ready-to-launch lures. Even so, researchers said Bluekit includes advanced evasion and attack features such as VPN and proxy blocking, headless-browser detection, fingerprint and device filtering, geolocation tricks, spoofing, voice cloning, antibot cloaking, and claimed support for bypassing two-factor authentication, raising concern that continued development could accelerate adoption in phishing campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers assessed Bluekit as more than a basic credential theft kit but still immature compared with more automated phishing platforms, warning that its frequent updates and expanding feature set could increase adoption by lower-tier cybercriminals and support future phishing campaigns.
Analysis found Bluekit offers more than 40 phishing templates targeting major brands and services and includes an AI Assistant panel listing models such as Llama, GPT-4.1, Claude, Gemini, and DeepSeek. Testing showed the AI feature was still immature, producing draft phishing content with placeholders rather than polished campaigns.
Varonis Threat Labs identified Bluekit as an actively developed phishing kit that combines domain registration, phishing page setup, anti-analysis controls, campaign management, and real-time victim session monitoring in a centralized dashboard.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Bluekit** phishing-as-a-service platform has expanded quickly and upgraded its credential-theft capability by shifting from adversary-in-the-middle methods to **browser-in-the-middle** attacks aimed at Microsoft logins. Netcraft identified nearly **70 live hostnames** in a week and reported that Bluekit streams an attacker-controlled browser session to victims using the legitimate `rrweb` JavaScript library over WebSockets, letting targets interact with the real Microsoft sign-in page while attackers capture credentials and authenticated session tokens in real time. Researchers said the approach can **bypass MFA** because authentication is completed inside the attacker’s browser, eliminating the browser-fingerprint mismatch often associated with reverse-proxy phishing kits such as Evilginx. Bluekit also includes anti-analysis and victim-filtering features including obfuscated JavaScript, randomized CSS filters, browser fingerprinting, WebRTC-based IP mismatch checks, fake brand-themed CAPTCHA pages, live victim monitoring, AI-assisted phishing email generation, and templates targeting major online services.
Jun 29, 2026
Cybercriminals are increasingly utilizing advanced Phishing-as-a-Service (PhaaS) kits to conduct large-scale, targeted phishing campaigns that impersonate trusted brands and institutions. These kits, which have doubled in number over the past year, enable even less-skilled attackers to deploy sophisticated attacks at scale by incorporating features such as URL obfuscation, MFA bypass, CAPTCHA abuse, and the use of malicious QR codes and attachments. Threat analysts have observed a surge in new PhaaS entrants, including Cephas, Whisper 2FA, and GhostFrame, alongside established kits like Tycoon 2FA and Mamba 2FA. Attackers are also leveraging AI, social engineering, and polymorphic techniques to evade detection, making it increasingly difficult for organizations to defend against these threats with static security controls alone. Technical analysis reveals that phishing infrastructure is evolving to include fake verification pages, such as counterfeit Cloudflare Turnstile challenges, which act as intelligent traffic filtering gates. These pages use browser fingerprinting, geolocation, and proxy detection to selectively deliver malicious payloads to high-confidence victims while evading security researchers and automated defenses. The fake verification pages closely mimic legitimate branding and user experience, including fabricated Ray IDs and links to real policy documents, to build trust and bypass scrutiny. Security experts recommend adopting layered defenses, including phishing-resistant MFA, continuous monitoring, and integrated email security, to counter these increasingly sophisticated phishing operations.
Jun 29, 2026
A sophisticated phishing campaign has emerged, leveraging AI-assisted development to target Microsoft Outlook users, particularly Spanish speakers. The operation, active since March 2025, employs a modular phishing kit that mimics the Outlook login interface and uses real-time reconnaissance to enrich stolen credentials with IP and geolocation data. Stolen information is exfiltrated via Telegram bots and Discord webhooks, and the kit's evolution shows clear signs of AI-generated code, including clean structure and Spanish-language comments. Researchers identified the campaign through a unique mushroom emoji signature embedded in the phishing kit, which has been observed in over 75 deployments. In a parallel development, another phishing wave has exploited Google Cloud Application Integration to send convincing emails from legitimate Google addresses, bypassing traditional security filters. This campaign, uncovered by Check Point researchers, uses a multi-stage process: victims receive official-looking emails, are redirected through Google infrastructure, and ultimately land on a fake Microsoft login page designed to harvest credentials. The attack has targeted over 3,000 organizations globally, with significant activity in the United States, Asia-Pacific, and Europe. Both campaigns demonstrate the increasing sophistication and global reach of phishing operations using advanced technical methods and trusted platforms to deceive users.
Jun 29, 2026