Bluekit’s Browser-in-the-Middle Phishing Is Now a Living, Breathing Threat

The New Normal: Your Login Page Is Already Compromised

You think you’re typing your password into Gmail. You’re not.

You’re typing it into a ghost. A perfect, real-time clone of Gmail — loaded from a server in Moldova or Latvia — that’s watching every keystroke, every mouse flicker, every second of hesitation. And when you hit "Sign In," the session doesn’t just get stolen. It gets handed over to the attacker’s browser, fully authenticated, fully live.

This isn’t phishing as we knew it. No fake URLs. No misspelled domains. No "Verify Your Account" emails that smell like old socks. This is something worse: browser-in-the-middle (BitM) phishing, powered by a tool called rrweb — a legitimate JavaScript library used by startups to replay user sessions for UX research — now weaponized by Bluekit, a phishing-as-a-service platform that’s grown from a sketchy side project into a full-blown cybercrime factory.

Netcraft tracked nearly 70 new Bluekit hostnames in the last week alone. That’s not a spike. That’s a steady, silent expansion. And the worst part? It’s working. Because you don’t see the fraud. Your browser doesn’t flag it. Your MFA app doesn’t scream. You just think you’re logging in.

How rrweb Became the Perfect Crime Tool

rrweb isn’t malware. It’s not even shady. It’s open-source. Used by companies like Notion and Figma to debug user flows. It records your DOM, your scrolls, your clicks — and replays them as a video.

Bluekit didn’t invent it. They just realized: if you can replay a session, you can live-stream it.

Here’s how it works:

1. You click a link. Maybe it’s in a phishing email. Maybe it’s a malicious ad. Maybe you thought you were clicking a Google Doc invite.
2. The page loads. It looks like your bank. Or Slack. Or your company’s SSO portal.
3. rrweb fires up. It grabs every pixel, every CSS class, every font, every image. It fetches them from Bluekit’s servers — so even the logo is faked, but perfectly faked.
4. You type your username. It’s sent over a WebSocket to the attacker’s browser, which is already logged in to your account — because they’ve been watching other victims do this for hours.
5. You type your password. Same thing. The attacker’s browser enters it. The real service says "Yes." The session token is handed back. The attacker now has your account.
6. You see the "Welcome back!" screen. You think you’re in. You’re not. You’re just a puppet.

The latency? A half-second delay on keystrokes. A flicker when the page loads. You think it’s your Wi-Fi. It’s not. It’s the middleman.

The Anti-Analysis Trap: When Phishing Gets Paranoid

Bluekit doesn’t just want your credentials. It wants to know you’re real.

They’ve built a whole suite of anti-research defenses — not to stop you, but to stop the security teams trying to catch them.

• Randomized CSS filters: Every time you load the page, the background color shifts slightly. A screenshot tool? It sees noise. A human? They don’t notice.
• Obfuscated JavaScript: A single JS file now weighs over 1MB. It’s minified, encrypted, and rotates every 15 minutes. Even if you deobfuscate it, it’s already changed.
• WebRTC IP mismatch: They check if your browser reports a different IP than the one you’re connecting from. If you’re on a VPN? The page loads a blank screen. No login. No alert. Just silence. They don’t want researchers. They want real people.
• Browser fingerprinting: They check your RAM, your screen resolution, your fonts, your time zone, even your installed plugins. If you’re running a headless browser? You’re blocked. If you’re on a corporate laptop with 17 security extensions? You’re blocked. If you’re on a real person’s device? You’re in.
• Custom CAPTCHA: Not Cloudflare. Not hCaptcha. Something custom. Designed to look like the brand you’re impersonating — a Microsoft login CAPTCHA, a PayPal puzzle, a Shopify image selector. It’s not hard. It’s just enough to stop automated crawlers.

This isn’t phishing. It’s behavioral filtering.

The Real Victim: You, the Human

The most terrifying part of Bluekit isn’t the tech.

It’s the psychology.

You’re not being tricked into clicking a bad link. You’re being tricked into trusting your own instincts.

You’ve been trained to look for typos. For weird domains. For "urgent" language. Bluekit gives you none of that. It gives you familiarity. It gives you normalcy.

You think you’re safe because you have MFA. You’re wrong. The attacker doesn’t need your code. They’re already in your session. Your phone buzzes with the push notification? They approve it. You type the code? They type it. You’re not being phished. You’re being replaced.

And the system? It doesn’t care. Your company’s SIEM doesn’t see an anomaly. Your EDR doesn’t flag a process. Your firewall sees a normal HTTPS connection to a domain that’s never been blacklisted.

This is the future of credential theft: not a breach. Not a leak. A replacement.

What You Can Actually Do (Yes, There’s Hope)

I know. You’re reading this thinking: "I’m not a target. I don’t have anything valuable."

You’re wrong.

Your email account is your digital ID. Your Slack is your work identity. Your bank login? That’s your money. Bluekit doesn’t care if you’re a CEO or a junior analyst. If you can log in, you’re a target.

Here’s what works:

• Look for delays. If your login takes 2 seconds longer than usual? Pause. Don’t type. Wait. If it’s a real site, it won’t matter. If it’s Bluekit? The delay is the fingerprint.
• Check your session. After you log in, go to your account settings. Look for active sessions. If you see a login from "unknown device" or "unknown location" — even if you just logged in — log out everywhere. Reset your password. Now.
• Use password managers with session detection. LastPass, 1Password, Bitwarden — they’ll tell you if you’re on a fake site. They don’t just auto-fill. They verify the domain’s behavior.
• Demand behavioral AI from your security team. If your company is still relying on signature-based detection or URL blacklists? They’re already behind. Ask for tools that analyze how users interact with login pages — not just where they go.

The End of the Phishing Era

We’ve spent 20 years fighting phishing as if it were a virus. We’ve trained people. We’ve blocked domains. We’ve added MFA.

Bluekit doesn’t care.

It doesn’t need to trick you. It just needs to be there — invisible, persistent, perfect.

The next time you log in, ask yourself: Is this really my browser? Or is it someone else’s — watching, waiting, ready to step in the moment you breathe?

You won’t know. And that’s the point.

This isn’t a threat you can patch. It’s a new reality.

We’re not defending against phishing anymore.

We’re defending against perception.