Bluekit PhaaS Randomized CSS Filter Obfuscation on Phishing Landing Page

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects web traffic containing specific randomized CSS filter properties on top-level elements, frequently seen in Bluekit PhaaS toolkits. These properties are used to alter the visual hash of the rendered page, complicating automated screenshot or pixel-based analysis by security vendors. This technique is often combined with suspicious URL patterns indicative of credential harvesting sites.