Bluekit BitM MFA Bypass: Phishing Click Followed by Sign-in from Different IP

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects potential Browser-in-the-Middle (AiTM) credential relay attacks where a user clicks a malicious phishing URL, followed shortly by a successful interactive sign-in from a different IP address and a previously unseen device.