Bluekit Phishing as a Service (PhaaS)

MITRE Techniques

• [T1566 ] Phishing – BlueKit uses phishing kits and brand impersonation to harvest credentials and session data through email, cloud, and smishing lures. [‘phishing templates for multiple global brands’]
• [T1185 ] Browser Session Hijacking – The platform captures session cookies and imports them into anti-detect browser workflows to replay authenticated sessions. [‘captures credentials, authentication tokens, and session cookies’]
• [T1110 ] Brute Force – Not directly brute force against accounts, but the platform supports credential harvesting at scale and automated post-capture workflows to exploit stolen logins. [‘large-scale credential harvesting’]
• [T1071.001 ] Web Protocols – BlueKit uses web-based phishing infrastructure and centralized dashboards to deliver and manage campaigns over HTTP/S-like web traffic. [‘centralized management dashboards’, ‘phishing page rendering model’]
• [T1090 ] Proxy – The platform stores configured proxy lists and uses proxy/VPN blocking to control access and obscure operator or victim traffic. [‘Configured proxy list’, ‘proxy/VPN blocking flag’]
• [T1583.001 ] Acquire Infrastructure: Domains – BlueKit operates multiple clearnet domains and a Tor onion service to host its phishing ecosystem. [‘Clearnet domains: bluekit[.]ws, bluekit[.]cc, bluekit[.]su, bluekit[.]pk’]
• [T1583.006 ] Acquire Infrastructure: Web Services – The operators rely on Cloudflare, Luxhost, CapSolver, NanoGPT, and Octo Browser as part of the phishing service stack. [‘DNS Provider Cloudflare’, ‘Registrar Integration Luxhost’, ‘CAPTCHA Solver CapSolver’]
• [T1027 ] Obfuscated Files or Information – The P2P rendering approach is designed to hide backend phishing infrastructure and evade conventional analysis. [‘obscure the phishing server origin from browser developer tools’]
• [T1650 ] Acquire Access via Application API – Reseller and distributor records expose API credentials and third-party service integrations used to run the platform. [‘platform-level API credentials’, ‘LuxHost API key’]
• [T1056.001 ] Keylogging – BlueKit collects identifiers, passwords, URLs, and credential artifacts from victim workflows, consistent with credential capture behavior. [‘latestIdentifier’, ‘latestPassword’, ‘latestUrl’]
• [T1552.001 ] Credentials in Files – The exposed database includes stored passwords, WebAuthn credentials, and operator authentication artifacts. [‘Argon2id password hash’, ‘Raw WebAuthn credential’]
• [T1113 ] Screen Capture – The article references victim dashboards and automated workflow views, but this is not directly evidenced; therefore the closest relevant behavior is credential and session capture. [‘victim data’, ‘authentication artifacts’]