Threat Intel
BlueKit Phishing-as-a-Service Enables Rapid Account Hijacking
BlueKit, a turnkey phishing platform, lets attackers launch sophisticated account‑hijacking campaigns in minutes. The kit includes a command center, tracking, and a library of 97 brand templates. Defenders should block known BlueKit domains, monitor for phishing emails, and harden MFA on high‑risk accounts.
What Happened
In August, Malwarebytes uncovered BlueKit, a phishing‑as‑a‑service (PhaaS) toolkit that bundles a command‑and‑control dashboard, victim tracking, and a library of pre‑built phishing pages. The service is offered by the underground operator “petrushka” and is marketed as a subscription that requires no technical skill to deploy.
Impact
BlueKit’s templates cover 97 brands across 176 variants, including major consumer sites (Amazon, Google, Apple), financial institutions (American Express, Bank of America), and cryptocurrency exchanges. The platform targets both consumer and business accounts, enabling attackers to harvest credentials, session tokens, and other sensitive data at scale.
What to Do
- Block IP addresses and domains listed in the latest BlueKit threat intelligence feeds.
- Enforce multi‑factor authentication on all accounts, especially for services that appear in BlueKit templates.
- Deploy email filtering rules that flag messages containing URLs or attachments matching known BlueKit patterns.
- Educate users to verify URLs and look for subtle brand inconsistencies before entering credentials.
Mitigation Tips
Implement a zero‑trust model for login pages, use DNS-based filtering to detect malicious redirects, and regularly audit login logs for anomalous activity.
Related articles
AI-Enhanced OSINT Enables Mass Targeted Fraud – Defenders Must Act
AI has turned public‑data gathering into a rapid, low‑skill activity, letting fraudsters build detailed victim profiles in seconds. This shift means anyone can become a target, increasing phishing and BEC attacks. Defenders need to treat public data as a threat vector and adopt specific mitigations.
Read briefing
Industrialized MaaS Drives Fake Coretax App Fraud in Indonesia
During Indonesia’s tax season, attackers pushed a counterfeit Coretax mobile application using a shared malware‑as‑a‑service platform. The infrastructure enables rapid brand abuse and phishing, targeting taxpayers and financial institutions. Defenders should block known malicious domains, monitor for Coretax app impersonations, and harden endpoint detection.
Read briefing
Tycoon 2FA AiTM: The Phishing‑as‑a‑Service Threat That Bypasses MFA on Entra ID & Google Workspace
Tycoon 2FA, the top‑selling phishing‑as‑a‑service kit, has evolved into a sophisticated adversary‑in‑the‑middle tool that captures MFA‑protected session tokens for Microsoft 365 and Google Workspace. After a March 2026 takedown, operators pivoted to device‑code phishing and OAuth abuse, keeping the kit at the forefront of global phishing trends. Elastic’s new detection rules map telemetry fingerprints across both platforms, enabling rapid incident containment in under ten seconds via Elastic Workflows.
Read briefing
Trezor Warns 347,000 Users After Brevo Email Breach Sparks Phishing Campaign
Trezor revealed that a breach of its email‑service partner Brevo exposed 347,000 opt‑in newsletter addresses, which were used in a phishing attack that lured 2,500 users into clicking a malicious link. The fake “critical security alert” email claimed a microcontroller flaw in Trezor wallets could expose seed phrases. Trezor shut down the phishing domain within 20 minutes and suspended the Brevo account, stating no other Trezor systems were compromised. The incident follows earlier breaches involving Trezor’s support portal and logistics provider ShipMonk.
Read briefing