Bluekit phishing kit adopts browser-in-the-middle for login theft

The Bluekit phishing-as-a-service platform added browser-in-the-middle (BitM) capabilities using the open-source rrweb library to stream login pages to victims. Nearly 70 new hostnames appeared over the past week. The attacker controls a browser session that loads the legitimate login page, captures credentials, and steals session tokens.