Bluekit BitM rrweb WebSocket Session Replay Exfiltration Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects network activity associated with Bluekit phishing infrastructure, which utilizes WebSocket connections for real-time browser session exfiltration. The rule monitors for characteristic HTTP upgrade requests to WebSockets containing 'rrweb' or 'session' query parameters, or connections to known Bluekit phishing domains, which allow attackers to stream DOM, keystrokes, and mouse movements from a victim's browser to an attacker-controlled dashboard.