Bluekit BitM rrweb DOM Streaming via WebSocket on Phishing Page

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects Browser-in-the-Middle (BitM) phishing attacks, such as Bluekit, that utilize the rrweb library for real-time DOM serialization and WebSocket streaming to capture user sessions. The rule correlates the presence of the rrweb library in HTTP traffic with WebSocket communication patterns containing session handshakes and serialized DOM payloads.