Bluekit PhaaS BitM Asset Proxying via WebSocket and Proxy API Endpoint

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects Browser-in-the-Middle (BitM) phishing infrastructure associated with PhaaS kits (e.g., Bluekit). The detection monitors proxy access logs for patterns where page assets (images, fonts, CSS) are fetched through a proxy API endpoint on behalf of the victim, combined with WebSocket connections used for real-time relay of victim inputs to the attacker.