BlueKit Phishing Automates Domain, 2FA Lures, and Session Hijacking

Key Takeaways

• Bluekit is a sophisticated, all-in-one phishing kit that streamlines complex phishing operations.
• It automates domain registration, deploys 2FA lures, and facilitates session hijacking from a single operator panel.
• The kit can bypass traditional two-factor authentication by capturing session tokens post-login.
• It includes over 40 website templates for popular services and features an integrated AI Assistant for campaign drafting.
• Organizations should implement phishing-resistant authentication methods like hardware security keys to mitigate risks.

A new, highly advanced phishing kit, dubbed Bluekit, is transforming the landscape of cybercrime by integrating multiple attack functionalities into a single, user-friendly operator panel. This sophisticated tool, recently analyzed by researchers, automates critical aspects of credential theft campaigns, including the deployment of two-factor authentication (2FA) bypasses, management of malicious domains, and execution of session hijacking.

Consolidated Phishing Capabilities

Historically, cybercriminals orchestrating complex phishing attacks were required to source various tools from different vendors—a credential-harvesting page from one, a domain rotator from another, and an SMS gateway from a third. This fragmented approach demanded significant technical expertise and considerable time investments.

Bluekit disrupts this model by consolidating all these capabilities into one intuitive dashboard. This centralization significantly lowers the barrier to entry, enabling even less experienced threat actors to launch highly polished and effective phishing campaigns. The kit boasts an impressive array of features, including over 40 website templates mimicking popular services, automated domain purchasing and registration, built-in 2FA support, sophisticated spoofing mechanisms, geolocation emulation, real-time Telegram notifications, and advanced anti-bot cloaking. Optional add-ons further enhance its capabilities, offering voice cloning and an integrated mail sender. More details can be found in the comprehensive analysis.

Varonis Threat Labs Uncovers Bluekit’s Inner Workings

Researchers at Varonis Threat Labs successfully identified and analyzed Bluekit after gaining access to the kit’s internal structure. Their investigation delved into the operator dashboard, the site-creation workflow, post-capture panels, and a built-in AI Assistant. The analysis revealed that Bluekit extends far beyond basic credential harvesting. Its operator panel provides extensive session data, including stored cookie dumps and local storage content, all captured after a target successfully logs in.

The templates examined by the Varonis team spanned a broad spectrum of widely used services, such as iCloud, Apple ID, Gmail, Outlook, Hotmail, Yahoo, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger. This wide selection enables attackers to target a diverse range of users and platforms with convincing lures.

The Impact of Bluekit’s Integration

The ramifications of Bluekit’s integrated design are substantial. By centralizing numerous steps in the phishing workflow, attackers can now rapidly deploy convincing phishing pages, register new domains, and actively monitor captured sessions without the cumbersome process of switching between disparate tools or platforms. The kit’s default exfiltration channel is integrated with Telegram, ensuring that stolen credentials and session tokens are transmitted to an attacker-controlled chat in real time. This rapid exfiltration reduces response time for attackers and complicates tracing efforts for defenders.

How Bluekit Hijacks Sessions After Login

Perhaps the most alarming feature of Bluekit is its inherent ability to hijack user sessions immediately after a victim submits their credentials. Session hijacking is not an add-on but a core component of the kit’s architecture. Within the “Mammoth Details” view, researchers observed Bluekit actively tracking session states, repeatedly dumping cookies and local storage data, and maintaining a live view of the target’s post-login activity.

This functionality means that even if a victim has enabled 2FA on their account, Bluekit is engineered to capture the session tokens generated after successful 2FA verification. This effectively bypasses the additional security layer, granting attackers full access to the compromised account.

The kit’s site-edit configuration panel offers granular control over various attack parameters from a single interface. Operators can configure login-detection actions, redirect behaviors, anti-analysis checks, spoofing options, and device filters. Furthermore, proxy settings and site-level checks related to post-login session handling can also be configured. This advanced level of control distinguishes Bluekit from older, simpler phishing kits that primarily focused on username and password collection. By managing the entire session lifecycle, attackers can compromise accounts even when robust modern authentication controls are in place.

Bluekit also incorporates an AI Assistant, accessible from its own panel within the dashboard. This assistant supports multiple AI models, defaulting to an adapted Llama model, with options for GPT-4.1, Claude Sonnet 4, Gemini, and various DeepSeek variants. During testing, the AI component successfully generated structured drafts for phishing campaigns, though these still required some manual refinement before being fully deployable.

What You Should Do

• Implement Phishing-Resistant Authentication: Organizations must prioritize and enforce phishing-resistant authentication methods, such as FIDO2-compliant hardware security keys. These methods provide stronger protection against session token theft, which can bypass standard 2FA.
• Enhanced Monitoring: Security teams should actively monitor for anomalous login locations, suspicious reuse of session tokens, and any attempts at cookie injection within their networks.
• Regular Employee Training: Conduct frequent and comprehensive security awareness training for employees to educate them on recognizing sophisticated lookalike login pages and other phishing indicators.
• Strict Domain Filtering: Network security teams should implement stringent domain reputation filtering to proactively block newly registered domains that are often used in phishing campaigns, preventing them from reaching end-users.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.