​Bluekit: The AI-Powered Phishing Kit Making Cybercrime Easier Than Ever

Security researchers at Varonis Threat Labs recently exposed Bluekit, a sophisticated new Phishing-as-a-Service (PhaaS) platform combining pre-built templates, real-time session hijacking, and an integrated AI assistant to help attackers run advanced campaigns with minimal technical skill.

This isn’t a basic fake login page. Bluekit represents the next evolution of phishing kits: professional, automated, and dangerously accessible—designed to trick a subscriber (in digital identity terms) into trusting a fake website, handing over credentials, or approving an “attack” that looks routine.

What Makes Bluekit Different?

• 40+ High-Quality Templates — Ready-to-deploy phishing pages for Apple iCloud, Gmail, Outlook, ProtonMail, GitHub, X/Twitter, Ledger wallets, Zara, and more. They look and behave very close to the real thing, mimicking real websites and even some official websites.
• Adversary-in-the-Middle (AiTM) Attacks — Bluekit doesn’t just steal passwords. It captures session cookies and browser data in real time, letting attackers bypass multi-factor authentication by hijacking active sessions—turning the “real verifier” into a counterfeit verifier (and effectively impersonating a trustworthy entity) long enough to get in.
• Built-in AI Assistant — Attackers chat with jailbroken versions of Llama, GPT-4.1, Claude, Gemini, and others directly in the dashboard to write phishing mail, generate campaigns, and tweak configurations using social engineering techniques.
• Full Automation — Domain buying, DNS setup, geolocation spoofing, antibot protection, live victim monitoring, and instant Telegram alerts — all in one sleek dashboard.

The kit is actively sold and rapidly updated under the alias “petrushka,” lowering the barrier to entry for less-experienced criminals and scaling deceptive computer-based means of credential theft and fraudulent solicitation. In identity language, this is designed to fool the relying party by compromising the verifier workflow (rp/rp risk) and abusing the user’s active session.

Photographer: freestocks | Source: Unsplash

Why This Matters

AI isn’t just powering innovation. It’s supercharging cybercrime. Tools like Bluekit make high-end phishing accessible to a much wider audience. As these kits evolve, we’ll see more convincing phishing scams targeting both everyday users and technical professionals—including smishing (SMS), vishing (voice phishing / 1.3 voice phishing), and email-based lures that pressure individuals to share sensitive information.

Beyond passwords, many campaigns aim to obtain sensitive personal information and other sensitive data (e.g., bank account numbers), creating a potential security issue that can lead to financial fraud. This aligns with long-standing terminology used in standards such as IETF RFC 4949 and guidance across NIST publications (including the NIST SP 1800 series and phishing-focused NIST SP 800 guidance) on how attackers exploit trust relationships among a subscriber, a verifier, and the relying party.

How to Protect Yourself

1. Never click unsolicited links — Treat unexpected email as phishing mail until proven otherwise; go directly to the official website (or secure .gov websites for government services) or use bookmarks to avoid a fake website.
2. Prefer hardware MFA — YubiKey or similar physical keys offer better protection against session hijacking (see 4.2.5 multi-factor authentication best practices), even when an attacker captures cookies.
3. Use a password manager — Unique, strong passwords limit damage and reduce the blast radius across legitimate business accounts.
4. Review active sessions regularly on critical accounts (4.2.4 monitoring) — If you see an unfamiliar device/session, revoke it immediately.
5. Stay updated — Enable advanced email filtering, browser protections, and mobile spam filtering to reduce smishing and malicious redirects; follow consumer alerts and consumer advice from reputable sources, and consider security awareness training (e.g., KnowBe4) for teams and families.
6. Never share sensitive personal information on demand — Especially not one-time codes, recovery phrases, “verification” details, or anything in digital form that could be reused by a perpetrator to impersonate you with a relying party or real verifier.

Final Thoughts

Bluekit is a clear reminder that the democratization of AI is a double-edged sword. As tech enthusiasts, staying informed and vigilant is our best defense—especially when attackers can convincingly pose as a reputable person or trustworthy entity via electronic communication.

P.S. Share this newsletter with friends and family who could use the heads-up. Awareness is the first layer of security for every subscriber.

Sources: Varonis Threat Labs (April 2026)