Executive Summary
An active campaign attributed to an affiliate of the BlueKit Phishing-as-a-Service (PhaaS) platform is targeting high-value executives within the financial services sector. The attack chain utilizes highly personalized, branded PDF lures to bypass initial scrutiny and directs victims through a multi-layered cloaking infrastructure including ZeroBot anti-analysis checks and geographic fencing.
Technically, the operation employs a 'Browser-in-the-Middle' (BitM) architecture that streams a live Microsoft 365 session to the victim via WebSockets while utilizing regional residential proxies to match the victim's location. This allows attackers to bypass multi-factor authentication (MFA) and establish persistence. Notably, the campaign extends beyond identity theft by attempting to deploy legitimate ScreenConnect remote monitoring and management (RMM) software following a successful login, pivoting from cloud identity compromise to full endpoint access.
This threat is significant due to its specialized targeting of chief executives whose accounts facilitate cross-entity financial approvals and its use of sophisticated evasion techniques that neutralize traditional reputation-based security controls. Organizations in asset management, investment banking, and fintech should immediately review their identity logs for the specific behavioral signals associated with BlueKit sessions.