Bluekit BitM: rrweb DOM stream fetch paired with WebSocket connection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects behavior indicative of Bluekit Browser-in-the-Middle (AiTM) phishing, where a client system fetches the rrweb DOM-serialization library followed by the establishment of a WebSocket connection within a 5-minute window. This sequence is consistent with live session recording or interactive DOM streaming from an attacker-controlled infrastructure.