# BlueKit technical analysis: Hijacking the login session directly on the attacker's browser through AI Tool

## Context & Targets

For many years, running an Adversary-in-the-Middle / Browser-in-the-Middle phishing campaign required attackers to assemble many disparate pieces of the puzzle themselves: purchasing the fake site source code from one seller, renting a domain rotator from a second, integrating an SMS gateway from a third party, and configuring a reverse proxy server themselves. The arrival of BlueKit in April 2026 removed this technical barrier by providing an all-in-one PhaaS.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/b364f762-6ffa-4790-a9d9-ed04c19159fb.png align="center")

According to analysis reports from Malwarebytes Labs, Varonis Threat Labs and Netcraft, BlueKit's pre-built interface inventory has grown rapidly from about 40 initial models to 97 brands with 176 phishing page variations in September 2026. Impersonated targets span many key areas:

*   Email, Cloud & Identity Services: Google (Gmail), Microsoft (Outlook, Hotmail, Microsoft 365), Apple (iCloud, Apple ID), Yahoo, ProtonMail, Zoho.
    
*   Developer Platforms & Technology: GitHub, X (Twitter).
    
*   Finance, Banking & Cryptocurrency: Ledger hardware wallets, cryptocurrency exchanges, payment gateways and banking systems in North America, Europe (typically banks in France) and the Asia-Pacific (APAC) region.
    
*   E-commerce & Telecommunications: Zara and many popular telecommunications carriers and online services.
    

## Threat Agent Profile: Portrait of petrushka

Behind BlueKit's expansion is not a state-sponsored APT group, but a developer and cybercriminal infrastructure provider operating for financial motives under the moniker petrushka. Data collected from Varonis Threat Labs, Netcraft and Malwarebytes shows that petrushka represents a generation of specialized cyber criminals: not directly distributing individual campaigns, but acting as a platform provider (Platform Provider) selling pre-packaged tools to thousands of downstream attackers (operators/affiliates).

### Identifiers & Activity Records

| Attribute | Details from Threat Intelligence |
| --- | --- |
| Alias | petrushka (in Russian, “petrushka” means parsley and is also the name of a Russian folk puppet character; however, reports from Varonis, Netcraft, and Malwarebytes have not reached an official conclusion regarding the actor’s nationality or actual geographic location). |
| Actor Classification | Phishing-as-a-Service Developer & Operator (PhaaS Developer / Vendor). |
| Motivation | Financially motivated: revenue from recurring subscription fees and sales of add-on modules. |
| First Observed | April 2026 (began openly selling BlueKit on underground cybercrime forums and maintaining an official Telegram channel). |
| Target Customers | Low-to-mid-tier cybercriminals, Account Takeover (ATO) groups, and financial fraud groups that need ready-made MFA-bypass infrastructure. |

### "Cybercrime SaaS" Business Model & Estimated Revenue

Different from the traditional intermittent transaction method on the black market, petrushka designed BlueKit according to the Software-as-a-Service (SaaS) model with a clearly stratified subscription price list:

*   7-day package: $250 — for burst campaigns.
    
*   14-day package: $480 — save about 4% compared to weekly renewals.
    
*   30-day plan: $940 — aimed at teams running ongoing credential capture campaigns.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/db789e04-7302-4af1-ac36-518a2c8838e9.png align="center")

On August 29, 2026 — just about 4 months after launch — petrushka announced on its official Telegram channel that the platform had reached 1,000 paying customers. Although claims from cybercriminals should always be viewed with caution as a publicity stunt, Malwarebytes's calculations show that the scale of the cash flow is very significant: even if each customer only buys a single package and does not renew, petrushka's gross revenue ranges from $250,000 to $940,000 (an average of about $557,000 if the ratio of buyers is evenly distributed in all 3 packages).

## Campaign Developments

The table below summarizes BlueKit's evolution from an emerging tool on an underground forum to a large-scale PhaaS platform in just 6 months:

| Date | Recorded Event | Verification Source |
| --- | --- | --- |
| April 2026 | The petrushka account began promoting and selling the BlueKit phishing kit on cybercrime forums, launching with more than 40 initial templates and an “Abliterated Llama” AI assistant. | Varonis Threat Labs / Malwarebytes |
| Late June 2026 | Netcraft detected BlueKit and analyzed its technical mechanisms in detail: a BitM architecture using rrweb, IP leak checks via WebRTC STUN, and UI obfuscation using CSS filters. It observed roughly 70 active hostnames per week. | Netcraft |
| 26/07/2026 | petrushka announced on the official Telegram channel that a built-in SMS sender was being developed directly within the platform. | Malwarebytes Labs |
| 10/08/2026 | The built-in SMS sending feature officially launched, allowing attackers to distribute phishing messages (smishing) from local US phone numbers. | Malwarebytes Labs |
| 29/08/2026 | The developer announced the platform had reached 1,000 customers, generating estimated gross revenue of $250,000 to $940,000. | Malwarebytes Labs |
| September 2026 | BlueKit released a major update: it expanded the template library to 97 brands with 176 variants, upgraded its session-theft machinery, and added advanced anti-analysis layers. | Malwarebytes Labs |
| October 2026 | Malwarebytes Labs and Gridinsoft published in-depth analysis reports on BlueKit’s “10-minute” operational workflow and the persistent risk posed by stolen login sessions. | Malwarebytes / Gridinsoft |

## Attack Chain Analysis

The entire attack flow of a campaign using BlueKit takes place in 4 closed stages, closely combining infrastructure automation, evasion of security scanning systems and real-time session interception:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/49faf273-7c5e-4511-8269-a7f570c16279.png align="center")

### Phase 1: Infrastructure Initialization & Decoy Distribution (Automated Setup & Delivery)

The process that previously took an attack team many days to prepare is now shortened to about 10 minutes right on the BlueKit console:

1.  Automated domain name management: Operators can purchase new or connect existing domain names directly from the control panel without switching between external domain name service providers.
    
2.  Create a decoy scenario with Guardrail-free LLM: Instead of having to find a way to "jailbreak" commercial AI tools that have strict safety filters, BlueKit has a built-in AI assistant using an open source model that has had all safety barriers removed (abliterated Llama). Thanks to that, attackers can ask AI to draft email content, impersonated SMS messages or phishing scripts in many languages ​​without encountering any rejection.
    
3.  Integrated multi-channel distribution: Through the SMS Sender module added since August 2026 (supports sending messages from domestic US numbers) and extensions such as mass email sending (mail sender) and voice cloning, attackers can spread phishing links directly to the target's phone and mailbox.
    

### Phase 2: Victim Screening & Defense Evasion

To protect the domain name infrastructure from being blacklisted by security firms, each phishing page created by BlueKit is covered by many layers of strict access control before displaying real content:

*   Over 1 MB of Obfuscated JS & Hardware Testing: When the browser loads the page, a block of heavily obfuscated JavaScript over 1 MB is executed to collect device fingerprints. This code checks hardware and browser environment metrics including: CPU core count, RAM capacity, WebGL graphics rendering parameters, list of fonts installed on the device, battery information (Battery API), and signs of automatic browser (headless browser). If a virtual machine environment or automated analysis tool is detected, the site will immediately refuse service.
    
*   VPN/Proxy detection via WebRTC STUN protocol: This is a very notable anti-analysis technique noted by Netcraft. BlueKit's JavaScript code forces the browser to perform a WebRTC STUN query over the UDP protocol to get the device's actual network-layer IP address, then compare it with the IP address of the current HTTP connection stream. Automated URL scanning systems from security vendors or researchers often route HTTP traffic through VPNs or residential proxies but forget to wrap UDP traffic. As soon as it detects a discrepancy between these two IP addresses, BlueKit recognizes this as an analysis connection and redirects it to a harmless decoy page.
    
*   Blinding Computer Vision Evasion systems with CSS Filter: Many modern phishing hunting systems take screenshots of websites and use artificial intelligence (Computer Vision) to identify logos or layouts of major brands. To fool these models, BlueKit automatically applies random CSS filter properties (such as slightly adjusting brightness, contrast, or hue-rotate) to interface elements. This variation is so small that the victim's naked eye cannot tell the difference, but it changes the pixel values ​​enough to break the scanner's automatic recognition threshold.
    
*   Custom geolocation, device, and CAPTCHA filters: Operators can configure to only allow victims from a specific country or a certain device type (e.g., only mobile access during smishing campaigns) to pass through, while blocking crawling bots with a separate CAPTCHA validation page.
    

### Phase 3: Session Stealing via Browser-in-the-Middle (BitM) Architecture

Unlike traditional Adversary-in-the-Middle (AiTM) kits, which act as a reverse proxy server that rewrites each HTTP/HTTPS packet between the victim and the target site, many variants of BlueKit use a more sophisticated Browser-in-the-Middle (BitM) architecture:

1.  Initiate a remote browser session: Once the victim passes anti-analysis checks, the attacker's server launches a headless browser and accesses the legitimate login page of the target service (such as login.microsoftonline.com or accounts.google.com).
    
2.  Real-time DOM streaming via rrweb and WebSockets: Instead of copying the brand's static HTML code, BlueKit uses the open source rrweb library (a legitimate tool that is used to record and replay interactive web sessions) combined with a two-way WebSockets connection. Any changes in the browser's DOM tree on the attacker's server are streamed directly to the victim's browser screen. In contrast, each mouse click and keystroke of the victim is transmitted back to the attacker's browser in real time.
    
3.  Disable MFA authentication process: Because the person who is actually communicating with the authentication server of the legitimate service is the browser located on the BlueKit server, when the service requests multi-factor authentication (entering the OTP code from SMS, TOTP code from the Authenticator application, or clicking to confirm Push Notification on the phone), that prompt will appear right in front of the victim's eyes with almost zero latency. The moment the victim completes the MFA step, a valid login session is established on the attacker's browser.
    

### Phase 4: Real-Time Data Extraction & Access Retention (Exfiltration & Persistence)

BlueKit's ultimate goal begins as soon as the login step is completed:

*   Comprehensive collection of session state: BlueKit's dashboard not only saves login names and passwords, but also continuously dumps all session cookies, authentication tokens and data in local storage generated after successful 2FA authentication, and allows attackers to directly observe the victim's session screen after login (post-login live view).
    
*   Default data smuggling channel via Telegram: All authentication information and session dumps are automatically sent to the attacker's Telegram chat group in real time. This allows hackers to react immediately as soon as the victim logs in.
    
*   Seizing control beyond the point of login (Session Replay): As analysis from Gridinsoft shows, modern authentication systems do not require users to re-enter passwords and MFA codes at each page transition, but rely on session tokens to maintain login status. When an attacker injects stolen cookies and tokens into his browser, the service server will consider it a valid session that has previously completed MFA. The attacker then has full rights to read emails, change security configurations, register new MFA devices, or perform financial transactions without triggering any additional login alerts.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/170f1c48-48c9-4c83-a49f-b97054146b91.png align="center")

## **MITRE ATT&CK**

| Tactic | Technique | ID | Specific Manifestation in the BlueKit Campaign |
| --- | --- | --- | --- |
| Resource Development | Acquire Infrastructure: Domains | T1583.001 | The control panel has built-in features to automatically purchase, register, and attach phishing domains directly to each campaign. |
| Resource Development | Obtain Capabilities: Tool | T1588.002 | The PhaaS model provides a full set of 176 template variants, an unrestricted AI tool (abliterated Llama), and an SMS sender for a subscription price of $250–$940. |
| Initial Access | Phishing: Spearphishing Link | T1566.002 | Phishing links are distributed via email and SMS (smishing) from local US phone numbers through the built-in SMS Sender tool. |
| Defense Evasion | Obfuscated Files or Information | T1027 | Uses more than 1 MB of heavily obfuscated JavaScript and applies randomized CSS filter properties to evade static scanning and Computer Vision systems. |
| Defense Evasion | Virtualization/Sandbox Evasion: System Checks | T1497.001 | Checks CPU core count, RAM size, WebGL, fonts, battery status, and headless browsers. Also compares IP discrepancies between UDP (WebRTC STUN) and HTTP. |
| Credential Access | Adversary-in-the-Middle | T1557 | Deploys a Browser-in-the-Middle (BitM) architecture via the rrweb library and WebSockets to stream the genuine login interface live and intercept the MFA authentication flow. |
| Credential Access | Steal Web Session Cookie | T1539 | Extracts all session cookies and local storage data immediately after the victim completes 2FA authentication. |
| Lateral Movement | Use Alternate Authentication Material: Web Session Cookie | T1550.004 | Replays stolen session tokens to gain unauthorized access to cloud, email, or financial accounts without needing a password or MFA. |
| Exfiltration | Exfiltration Over Web Service | T1567 | Automatically sends login credentials, session data, and victim status notifications in real time to the attacker’s Telegram channel. |

## Defense Recommendations & Risk Mitigation

To neutralize the attack chain of new generation PhaaS platforms like BlueKit, businesses need to deploy a defense-in-depth strategy, closely combining pre-login prevention and post-login control:

### Immediate Actions — Taken when intrusion is suspected

1.  Revoke all active sessions (Revoke Active Sessions): When detecting an account showing signs of falling into BlueKit's trap, simply changing the password is not enough because the issued session cookies may still be valid. Administrators must revoke all refresh tokens and session tokens immediately (for example, run the Revoke-MgUserSignInSession command on Microsoft Graph PowerShell or select "Revoke sessions" on Google Workspace Admin).
    
2.  Post-Compromise Audit: Immediately review the list of newly registered MFA devices, automatic email forwarding or hiding rules (Inbox Forwarding / RSS Rules), API keys or third-party OAuth applications that were authorized during the session.
    

### Medium and Long Term Technical Control

1.  Phishing-Resistant MFA — FIDO2 / Passkeys required:
    
    *   Convert from MFA methods that are susceptible to intermediary interception (SMS OTP, Email OTP, TOTP, Push Notification) to FIDO2 / WebAuthn standard (physical security keys such as YubiKey or Passkeys integrated on the device), at least for all administrator accounts (Privileged Accounts), leaders (VIPs) and Finance - Accounting departments.
        
    *   Technical mechanism: The FIDO2 protocol cryptographically binds the authentication process to the origin domain and the TLS connection channel. In BlueKit's BitM or AiTM architecture, even though the interface appears identical to the real page, the domain name in the victim's browser address bar is still the attacker's phishing domain name, causing the FIDO2 key to refuse to authenticate or create a signature that is invalid for the real service.
        
2.  Binding Sessions to Devices (Device-Bound Session Credentials / Token Protection):
    
    *   Enable the Token Protection policy (in Conditional Access of Microsoft Entra ID) or Device Bound Session Credentials (DBSC) to tie the session token to the hardware key (TPM) of the device that logged in. If an attacker were to extract the cookie via BlueKit and bring it to another computer to reload it, the server would reject it because there is no confirmation signature from the original device's TPM chip.
        
3.  Continuous Access Evaluation (CAE) & Shorten Session Lifespan:
    
    *   Enable CAE so the identity system can invalidate sessions almost instantly when it detects sudden IP address changes (IP drift), ASN changes, or increased user risk.
        
    *   Limit session lifetime and disallow "Keep me signed in" status for sensitive applications when accessing from external networks.
        
4.  Blocking Newly Registered Domain Names (NRD Blocking) at Network & Email Portal:
    
    *   Because BlueKit customers continuously purchase new domain names through an automated control panel, configuring DNS Firewall, Secure Web Gateway (SWG), and email security gateway to block or Browser Isolation of new domains registered less than 14–30 days ago will significantly reduce the possibility of users reaching phishing sites.
        

## Expert Perspective

From the perspective of real-world cybersecurity operations, BlueKit's explosion with more than 1,000 customers in just a few months shows a landmark shift in the cybercrime market: The complete industrialization of session hijacking techniques (Session Hijacking Industrialization).

Previously, the Browser-in-the-Middle (BitM) technique or the abuse of the WebRTC STUN protocol to expose the analysis systems of security firms was only in the hands of highly technically skilled attack groups. Now, for $250 for 7 days of usage and the help of abliterated Llama models, any low-level fraudster can deploy a complete MFA circumvention infrastructure in just a few clicks. In other words, AI does not directly "crack" the authentication system, but acts as a speed and scale amplifier, helping attackers localize the decoy language to any country without language barriers.

In the context of Vietnam, risks from platforms like BlueKit are especially serious. Currently, the majority of businesses, financial institutions, digital banks and state agencies in Vietnam have deployed MFA, but the vast majority still depend on SMS OTP, Email OTP, Smart OTP with code input (TOTP) or confirmation via push notification. Before BlueKit's real-time DOM streaming architecture (rrweb + WebSockets), all of these MFA methods could be bypassed if the user let their guard down and entered code on the rogue page. Moreover, thanks to the built-in large uncensored language model, foreign hackers or fraud groups in the region can create fake scenarios for internal business announcements, tax warnings, banks or trading floors in natural Vietnamese, without the silly translation errors like before.

If I could pick only one priority to recommend to CISOs and SOC heads right now: Stop thinking of "successful MFA login" as the end point of the security control process. As long as businesses have not completed the transition to FIDO2/Passkeys and bound device-bound tokens, the ability to detect account takeover behavior early depends entirely on whether the SOC can monitor unusual movements of Session ID after login time.

## References

[AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes | Malwarebytes](https://www.malwarebytes.com/blog/threat-intel/2026/10/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutes)

[BlueKit Phishing: A Stolen Session Can Outlast the Login](https://blog.gridinsoft.com/bluekit-phishing-stolen-session-access/)

[BlueKit Phishing Service Hijacks Accounts With AI in 10 Minutes](https://for.you.com/posts/bluekit-phishing-service-hijacks-accounts-with-ai-in-10-06167f20)