Bluekit PhaaS BitM rrweb DOM Streaming WebSocket Session Hijack

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects network communication associated with the Bluekit phishing framework and the use of the rrweb library to capture web sessions, including WebSocket upgrade attempts which may indicate unauthorized user activity monitoring or credential harvesting.