Bluekit BitM: rrweb DOM Stream WebSocket on Phishing Page

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects potential Browser-in-the-Middle (BitM) phishing activity by identifying a client browser that fetches the 'rrweb' session-recording library followed by a WebSocket connection to a different origin within 5 minutes. This sequence is indicative of an attacker-controlled browser streaming the victim's DOM and interaction events to a phishing infrastructure.