Bluekit PhaaS Session Hijack: Post-Auth Password Reset and Passkey Enrollment

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•11

Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.