Bluekit BitM rrweb WebSocket Keystroke and Mouse Relay to Attacker C2

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects anomalous WebSocket connections on web pages that utilize the 'rrweb' session replay library, often used by phishing infrastructure such as the Bluekit Browser-in-the-Middle (AiTM) kit to capture and relay real-time victim input (keystrokes and mouse movements) to attacker-controlled consoles.