Bluekit BitM Keystroke/Mouse Relay via Bidirectional WebSocket with rrweb

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.