Bluekit phishing kit
Bluekit is a browser-in-the-middle phishing kit. Its page shows a fake human check, then a live copy of a real login page running in the attacker's browser. We have matched it on 4 sites since 5 November.
Bluekit in numbers
Since 5 November, the first Bluekit match in our records, counted on 6 November 2026. How we count.
| Sites with Bluekit code | 4 |
|---|---|
| Sites with a match in the last 30 days | 4 |
| Last match | 6 November |
A phishing service that mirrors the real login
Netcraft named Bluekit in June 2026: a phishing service whose pages run the real sign-in in the attacker's browser and stream it to the victim. The victim types into what looks like the real site, and the attacker's browser keeps the session. Netcraft lists its traits: a custom check page, a WebRTC check for the visitor's real IP address, encrypted WebSocket traffic, the rrweb replay library, and colour filters that change on every visit. The bundle we capture carries every one of them.
Public scans show the kit since July 2026 on domains named for Okta, Microsoft 365, Google, Apple, Amazon and Coinbase.
The page looks empty
The visitor lands on a long hex path. The HTML has no title, a few hidden paragraphs of lorem ipsum with random class names, and one script, /assets/index.js. A scanner that reads the HTML sees a blank placeholder page.
The script is about 550 KB. Every string in it is stored as pairs of numbers, decoded at run time with an XOR or an offset that changes per build. One build we decoded holds 2,125 strings.
A fake check first
The script reads /api/config and shows a human check in one of six styles: Cloudflare, reCAPTCHA, Apple, Amazon, Microsoft, or one the code calls Sentinel. The Amazon style tells the visitor "We just need to confirm you're a real shopper." While the check is on screen, the script tests for headless Chrome and webdriver, and asks Google and Cloudflare STUN servers for the visitor's real address.
It also adds a random hue-rotate, brightness, contrast and saturation filter to the page, so no two screenshots match.
Then a live mirror
Behind the check, the script opens an encrypted WebSocket and waits for a message it logs as mirror-ready. What arrives is a recording of a page running in the attacker's browser, replayed with rrweb. The visitor's clicks, taps and keys go back over the same socket, so the visitor is using the real login page through the attacker's browser. Passwords and one-time codes go into that session.
When the visitor signs in, the script logs login detected: to /api/log.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 0 |
| November so far | 4 |
Checking for Bluekit
A Bluekit page shows up in network logs more than in its HTML. Look for:
- a page with an empty title, hidden lorem-ipsum paragraphs and a single
/assets/index.js - requests to
/api/configand/api/logfrom that page - WebRTC STUN requests to
stun.l.google.comorstun.cloudflare.comfrom a login page - a binary WebSocket that starts after a human check passes
- a login page whose colours shift from visit to visit
Anyone who signed in through one of these pages should sign out all sessions, change the password and remove any MFA method or passkey they did not add.