Bluekit PhaaS rrweb encrypted WebSocket C2 channel to operator domains

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects network activity associated with the Bluekit PhaaS (Phishing-as-a-Service) BitM (Browser-in-the-Browser) C2 infrastructure. It monitors for connections to known malicious domains, the use of WebSocket upgrades over TLS, and the presence of 'rrweb' (a DOM recording library) in request URIs, which are indicative of browser-in-the-browser phishing C2 traffic.