Bluekit PhaaS Encrypted WebSocket C2 Session Token Exfiltration

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects encrypted WebSocket sessions over non-standard ports or TLS traffic patterns indicative of Bluekit Phishing-as-a-Service (PaaS) session token exfiltration to unauthorized command and control (C2) infrastructure.