Bluekit BitM Session Hijack — Parallel Session from Geographically Distinct IP After MFA

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•2

Detects potential Browser-in-the-Middle (BitM) session hijacking by identifying scenarios where a single user account authenticates successfully from multiple geographically distinct external IP addresses within a short (10-minute) window, suggesting a parallel session is being used by an attacker.