Bluekit PhaaS Credential Exfiltration via Encrypted WebSocket and HTTPS to C2

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.