Bluekit BitM MFA Bypass - Session Reuse from Unexpected IP Post-MFA

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

Detects session hijacking consistent with Browser-in-the-Middle (BitM) attacks like Bluekit PhaaS, where an attacker captures an authenticated session token. The rule identifies instances where a successful MFA-protected login event is immediately followed by a session reuse event from a different IP address or network location, which is indicative of the attacker utilizing the intercepted session.