In April 2026, researchers called it “still in development.” By June, it was running 70 live hostnames a week and had doubled its template library to 87 brand impersonation kits.
Eight weeks is not a long time in cybersecurity product development. It is, apparently, plenty of time to build a phishing operation.
When Varonis Threat Labs published the first detailed look at BlueKit in late April 2026, the language was careful. The platform was new, the AI assistant produced outlines rather than deployable campaigns, and the overall assessment landed at “still in development.” A reasonable conclusion from the evidence available at the time.
By mid-June, the picture had shifted. CloudSEK’s dark web monitoring team independently investigated the same platform and found something that “still in development” no longer covered: 87 phishing templates targeting banks, cloud platforms, cryptocurrency services, and ecommerce brands globally. A reseller network accepting cryptocurrency. A peer-to-peer page rendering model designed to hide infrastructure from researchers. Automated deployment at scale, with new hostnames appearing weekly.
The velocity is notable. What makes BlueKit worth examining is not how fast it grew but what it introduced.
Browser-in-the-Middle: a different kind of proxy
The phishing-as-a-service platforms that have dominated the past three years all share an architecture. Tycoon 2FA, Evilginx, Rockstar 2FA, Mamba 2FA: each positions a reverse proxy between the victim and the legitimate login page, capturing credentials and session tokens as the traffic passes through. Effective, but the approach leaves fingerprints: timing anomalies, TLS mismatches, header discrepancies. Defenders have learned to read those signals, and detection tools have been built around them.
BlueKit does something different. Rather than proxying the victim’s connection, it loads the real login page inside an attacker-controlled browser and streams that session to the victim using rrweb, an open-source library originally built for session replay and debugging. What the victim sees is the real Microsoft login page. What they interact with is the real authentication flow. Their keystrokes relay to the attacker’s browser, which executes them against the real service, and the resulting session token belongs to the attacker.
The technique is called Browser-in-the-Middle, and it matters for a specific reason. In a traditional adversary-in-the-middle setup, the attacker’s infrastructure sits between the victim and the real service, creating artifacts that network-level and identity-level detections can exploit. In BitM, there is no proxy. A real browser talks to a real service. The fingerprinting that catches Evilginx, the mismatched user agents and unexpected TLS termination and timing patterns that betray an intermediary, has nothing to latch onto.
HYPR’s analysis of BlueKit landed on an observation that cuts to the heart of it: “Attackers are investing less effort into defeating authentication technologies and more effort into controlling the environments in which authentication takes place.” That sentence is worth sitting with, because it describes not just BlueKit but the direction the entire PhaaS ecosystem is moving, away from the adversary-in-the-middle model that defenders were starting to catch.
What the operator sees
Varonis obtained access to BlueKit’s dashboard, and what they documented looks less like a hacking tool than like a SaaS product. Domain registration, phishing page creation, campaign management, credential harvesting, and Telegram-based exfiltration, all integrated into a single panel. Operators pick a brand from the template library, configure the page behavior, and launch.
The part that deserves specific attention is the real-time monitoring. BlueKit uses the same rrweb infrastructure that powers its delivery to stream a live view of each victim’s session back to the operator. Demonstrations shared on Telegram show operators watching their targets navigate the phishing page in real time, observing what happens after login, intervening when needed. This is not a log reviewed after the fact. It is a social engineering operation with a live feed.
Eighty-seven brands in a dropdown menu
Somewhere in BlueKit’s operator panel is a dropdown menu where you select whose customers you want to steal from today. The choices doubled from 40 to 87 between April and June, and the names read like a directory of the services people trust most with their credentials: iCloud, Apple ID, Gmail, Outlook, Yahoo, ProtonMail, GitHub, Twitter, Zoho, Zara, Ledger, and dozens of financial institutions across multiple countries.
What the victim encounters, though, is not a static screenshot of their bank’s login page. Through the BitM architecture, they are seeing the real page, rendered in real time, bearing the real brand’s design and trust signals. Every visual choice the legitimate organization made to communicate trustworthiness is reproduced precisely, not because the attacker copied it, but because the architecture streams the original. The brand’s identity is not being replicated. It is being borrowed, live, for as long as the session lasts.
CloudSEK’s investigation puts a shape on what that looks like at scale. Dozens of simultaneous impersonation campaigns, each one bearing a real brand’s name, directed at that brand’s customers, rendering that brand’s actual login experience. The campaigns will be identified and taken down. The templates will persist. And adding the next brand to the library is, architecturally, selecting it from that dropdown.
The Bottom Line
BlueKit is not the first phishing-as-a-service platform, and it will not be the last. What makes it worth watching is what it retired. The reverse proxy architecture that defined the previous generation of MFA-bypassing platforms created detection opportunities that defenders were beginning to exploit. Browser-in-the-Middle eliminates those opportunities by removing the proxy entirely, and the components it relies on, including the rrweb library at its core, are open-source and freely available. If the technique proves more resilient to detection than the model it replaces, the rest of the PhaaS ecosystem, already compressing its development cycles from years to weeks, will adopt it. The 87 brands in BlueKit’s template library are the organizations paying the cost of that transition, one login page at a time.
Key Takeaways
BlueKit is a phishing-as-a-service platform that provides a complete phishing infrastructure including 87 brand impersonation templates, automated campaign deployment, real-time victim monitoring, and credential harvesting. First documented by Varonis in April 2026, CloudSEK confirmed it was operational at scale by June 2026, with a reseller network, peer-to-peer infrastructure, and automated deployment across multiple countries. The platform is sold through dark web channels with cryptocurrency payment.
Browser-in-the-Middle loads the real login page inside an attacker-controlled browser and streams it to the victim using rrweb, an open-source session replay library. Unlike reverse proxy AitM tools like Evilginx, which intercept traffic between the victim and the real site, BitM has no proxy in the authentication flow. The session originates from a real browser talking to a real service, which eliminates the forensic signatures that defenders use to detect proxy-based phishing.
BlueKit’s template library grew from 40 to 87 brands between April and June 2026. Templates target email providers (Gmail, Outlook, Yahoo, ProtonMail, iCloud), developer platforms (GitHub), social media (Twitter), retail (Zara), cryptocurrency (Ledger), and financial institutions across multiple countries. Each template renders the target brand’s actual login page in real time through the BitM architecture.
BlueKit includes an AI assistant supporting multiple language models including Llama, GPT-4.1, Claude, Gemini, and DeepSeek. However, Varonis testing found only the Llama model was fully functional, producing structured outlines rather than deployable campaigns. The AI component functions as a planning tool rather than an automated phishing generator, though the feature is under active development.
BlueKit went from first documentation to confirmed operational scale in approximately eight weeks. The template library doubled from 40 to 87 in that period. This velocity is consistent with the compression pattern observed across PhaaS platforms including Tycoon 2FA, EvilTokens, and Kali365, where each successive platform reaches scale faster than its predecessors.
