Phishing-as-a-Service Kit Makes Credential Theft Possible in Ten Minutes

In early August, Malwarebytes reported that a new phishing‑as‑a‑service kit called BlueKit lets criminals create a full‑scale credential‑theft operation in about ten minutes. The package includes a ready‑to‑use website template library, a dashboard for managing victims, and an AI assistant that writes scam messages. Because the service is sold on a subscription basis, even actors with limited technical knowledge can launch sophisticated attacks quickly.

What BlueKit Offers

According to Malwarebytes, BlueKit presents a library of nearly one hundred brand templates, covering consumer services like Amazon and Google, financial institutions such as American Express, and business platforms including Salesforce, GitHub and Cloudflare. The templates are described by the operators as “pixel‑perfect and ready to deploy in one click.” The service also includes tools for tracking victims, capturing session data and sending SMS messages directly from the dashboard. A September update improved the visual realism of the fake sites and refined the hidden code that steals session information.

Why It Raises Risks for Small Organizations

BlueKit’s ability to collect more than just passwords makes it a serious threat. The kit records a device fingerprint that captures IP address, browser details, screen size and other hardware signals. Many security solutions use these signals to verify a user’s device, so an attacker who can reproduce the fingerprint can slip past those checks. The kit also steals session cookies, which act like a VIP wristband that lets a logged‑in user move around a site without re‑entering credentials. With a stolen cookie, an attacker can paste it into their own browser and gain instant access to an active account, often without needing a two‑factor code. This means that even organizations that enforce strong password policies can be compromised if a user’s session is hijacked.

How AI Amplifies the Threat

What sets BlueKit apart from older phishing kits is its built‑in AI assistant. The service advertises an “unrestricted” model that will answer any prompt, including those that request fraudulent content. Attackers can ask the AI to draft convincing phishing emails, craft SMS messages that appear to come from a local US number, or even generate persuasive copy for fake login pages. Because the AI removes safety filters, scammers can produce high‑quality social engineering material at scale, further lowering the barrier to entry for inexperienced criminals.

Practical Steps to Defend

Below are actions any small business, nonprofit or public‑sector team can take today to reduce the risk posed by kits like BlueKit:

• Enable multi‑factor authentication (MFA) on all accounts that support it, and configure it to require a separate device rather than just a code that can be intercepted.
• Regularly review active session lists in email, financial and SaaS platforms; terminate any sessions that are not recognized.
• Deploy a web‑filter that blocks known phishing domains and scans outbound email for suspicious links.
• Educate users about the danger of unsolicited text messages (smishing) and advise them to verify any request for credentials through an independent channel.
• Keep software, especially browsers and security extensions, up to date to reduce the chance of a device fingerprint being harvested by malicious scripts.
• Conduct periodic phishing simulations that include realistic email and SMS scenarios, so staff learn to spot the cues of a fabricated message.

For a deeper look at what attackers can already learn from your public website, see our guide on how to protect your online presence.

What to Watch For

BlueKit’s operators announced new features on a public Telegram channel, including a built‑in SMS sender that can use local US numbers. Keep an eye on any sudden increase in SMS‑based scam attempts that reference familiar brands or internal tools. Also monitor any reports of session hijacking where a user’s account is accessed without a password prompt, as this can be a sign that a stolen cookie is being reused. Finally, stay aware of new phishing‑as‑a‑service offerings that bundle AI, because the ease of creation means the volume of attacks is likely to rise.

By treating the threat as a service rather than a one‑off tool, BlueKit illustrates how cybercriminals are professionalizing their operations. Organizations that combine technical controls with regular user training will be best positioned to thwart these fast‑setup attacks.