Bluekit Phishing Kit Uses Browser-in-the-Middle to Steal MFA-Protected Microsoft Sessions

The Bluekit phishing-as-a-service platform has expanded quickly and upgraded its credential-theft capability by shifting from adversary-in-the-middle methods to browser-in-the-middle attacks aimed at Microsoft logins. Netcraft identified nearly 70 live hostnames in a week and reported that Bluekit streams an attacker-controlled browser session to victims using the legitimate rrweb JavaScript library over WebSockets, letting targets interact with the real Microsoft sign-in page while attackers capture credentials and authenticated session tokens in real time.

Researchers said the approach can bypass MFA because authentication is completed inside the attacker’s browser, eliminating the browser-fingerprint mismatch often associated with reverse-proxy phishing kits such as Evilginx. Bluekit also includes anti-analysis and victim-filtering features including obfuscated JavaScript, randomized CSS filters, browser fingerprinting, WebRTC-based IP mismatch checks, fake brand-themed CAPTCHA pages, live victim monitoring, AI-assisted phishing email generation, and templates targeting major online services.