Key takeaways
BlueKit is a phishing-as-a-service platform that lets an attacker with no technical skill stand up a "pixel-perfect" fake login page in around ten minutes, starting at $250 for seven days, with 1,000+ claimed customers (source).
Its template library impersonates 97 brands across 176 variants, spanning consumer services, banks and crypto exchanges, social media, AI platforms, and crucially corporate SSO and SaaS such as Salesforce, HubSpot, GitHub, Citrix, Cloudflare, and Cisco.
It steals more than passwords. It captures device fingerprints, session cookies, and passkeys, which lets an attacker replay a live session and walk past multi-factor authentication.
It ships with a built-in "no-rules" AI assistant to write the phishing emails and texts, plus an SMS module for smishing, so the lures are polished and localized by default.
When convincing fakes are this cheap and this numerous, training people to spot them and filtering them at the gateway both stop scaling. The one check that scales with the flood is verifying the page itself, in the browser, at the moment of use.
For years, the comforting assumption behind most phishing advice was that good fakes were hard to make. Building a convincing clone of a login page, wiring up the infrastructure to capture what people typed, and evading detection took skill, which meant the truly dangerous attacks were relatively rare and the rest gave themselves away. That assumption is now obsolete, and a kit that Malwarebytes researchers just profiled is a clean illustration of why.
The kit is called BlueKit, and it is phishing-as-a-service: a subscription product, sold like legitimate software, that arms almost anyone with account-hijacking tools in about ten minutes. The cheapest plan is $250 for seven days. The operators claim more than 1,000 customers. You do not need to understand how any of it works. You sign up, connect a domain, pick a target brand from a library, and you are running a sophisticated campaign before lunch.
For any business that relies on its people recognizing a fake, and that is most businesses, this changes the math in a way worth sitting with.
What BlueKit actually is
It helps to be precise about what has been commoditized here, because it is not just a fake web page.
BlueKit bundles the whole operation into one dashboard: a library of ready-made login clones, the back-end infrastructure that captures and manages what victims hand over, victim tracking, and campaign management. Malwarebytes has tracked it since it appeared on a cybercrime forum in April, watching its operators ship updates on a public Telegram channel the way a normal software company ships releases. In July they announced a built-in SMS sender for smishing, complete with local US phone numbers to make texts look more trustworthy. In September they upgraded the templates to look even more convincing and improved the technology they use to steal and manage sessions.
The template library is the part that should get a business's attention. As of September it covered 97 brands across 176 variants, and it is not only consumer brands. Alongside Amazon, Google, Apple, banks, crypto exchanges, and social platforms, the kit sells ready-made clones of the exact systems a company runs on: Salesforce, HubSpot, GitHub, and single sign-on and security gateways including Citrix, Cloudflare, and Cisco. It even impersonates AI platform logins like OpenAI and Anthropic. In other words, the fake your employee sees might not be a consumer brand they use at home. It might be the SSO page they sign into every morning.
Why this breaks two defenses most businesses lean on
Commoditization does not just mean more attacks. It changes which defenses can keep up, and it quietly retires two of the most common ones.
Training people to spot the fake
Security awareness training rests on the idea that a fake has tells a trained person can catch. BlueKit's whole value proposition is that its pages are "pixel-perfect" and its messages are written by a built-in AI with the guardrails removed, so they arrive polished, personalized, and free of the typos and clumsy phrasing people were taught to look for. As we have argued in please stop telling people to look for spelling mistakes, the tells have been engineered out. Asking an employee to distinguish a flawless clone of your own SSO page from the real thing, in the two seconds before they sign in, is not a fair test, and designing your defense around them passing it is how capable teams still get breached.
Filtering it at the gateway
The other instinct is to catch it in the email. But BlueKit also sends over SMS now, which skips the email gateway entirely, and when the volume of unique, freshly stood-up phishing sites is effectively unlimited, blocklists and reputation checks are always a step behind. You cannot blocklist your way out of a problem where a new, convincing site can be live ten minutes after someone decides to target you.
The part that makes it worse: it beats MFA
BlueKit does not stop at passwords. It captures the device fingerprint, the session cookies, and even passkeys. The session cookie is the important one. Malwarebytes uses a good analogy: logging in is like showing your ticket at a concert and getting a wristband, and the site checks the wristband, not the ticket, for the rest of the night. BlueKit steals the wristband. With your live session cookie, an attacker pastes it into their own browser and is already inside your account. They do not need your password again, and they do not face a second-factor prompt, because the site already believes the login happened. This is the same session-theft logic behind the phishing-as-a-service operation we broke down in a phishing service that beat MFA at 258 companies. BlueKit packages it for a much wider set of buyers.
The real shift: the barrier to entry collapsed
Step back from the mechanics and the story is about economics, and it is the same story the biggest reports of the year keep telling. When Anthropic and Microsoft each described attacks being produced at scale because AI collapsed their cost, BlueKit is what that looks like with a price tag attached. Sophisticated, convincing, MFA-bypassing phishing used to require a skilled operator. Now it requires $250 and ten minutes, and more than a thousand people have reportedly bought in. The supply of pixel-perfect fakes aimed at your employees and your customers is no longer limited by attacker skill. It is limited only by demand, and demand is clearly there.
That is the uncomfortable core of it. You are not defending against a handful of elite adversaries anymore. You are defending against a product, one that any number of low-skill criminals can rent, pointed at the consumer brands your people use and the corporate systems your business runs on.
What actually scales against it
If training cannot carry the load and filtering is always behind, the defense has to move to the one place every one of these attacks has to pass through: the rendered page, in the browser, at the moment someone is about to enter credentials. That is the only checkpoint that scales with the flood, because it does not care how the victim arrived, how new the domain is, or how perfect the clone looks. It only asks what the page actually is.
That is where Haven works. Haven is a browser extension that checks whether a page truly is who it claims to be, rather than trusting its reputation, its domain age, or how convincing it looks. When an employee lands on a BlueKit-built clone of your SSO page, your Microsoft login, or your bank, Haven flags it as an impersonated login before they type anything. It does not rely on the page being on a known-bad list, which matters when a new one can appear in ten minutes, and it does not rely on the person spotting a flaw that a professional kit has specifically removed.
To be precise about scope, because that is how we earn trust: Haven is not an email or SMS gateway, so it does not stop the phishing email or the smishing text that starts the chain, and it is not a replacement for passkeys and MFA. In fact BlueKit is a reminder of why passkeys and phishing-resistant MFA still matter and why they are not sufficient on their own, since this kit is built to steal the session after a login completes. Haven's job is the step in between: catching the fake page at the point of entry, before credentials or a session are ever handed over. Paired with phishing-resistant MFA, that closes the gap this kit is designed to exploit.
For organizations, this is squarely a Haven for Business problem, because BlueKit sells clones of the corporate systems your whole team signs into, and it only takes one employee reaching one convincing fake. Extending a browser-level check across every employee is the control that scales at the same rate the attacks now do. We have written before about why the browser has become the place these decisions are won or lost, in the browser is the new OS, secure it like one.
The era when a good fake was rare is over. When anyone can rent a perfect one for $250, you cannot out-train or out-filter the supply. You can only make sure that something is checking the page itself, every time, at the one moment that decides the outcome.
About Haven
Haven is a browser extension that helps people make safer trust decisions online, before a scam can cost anything. It works at the moment someone is about to click a link or enter a password, flagging fake and impersonated login pages, suspicious links, and look-alike sites, and pausing risky downloads. Rather than only checking a page against a list of known-bad sites, Haven analyzes the actual page in front of the user, so it can catch brand-new and convincing fakes that other tools miss.
Haven is free for individual use. For teams, Haven for Business extends this browser-level protection across every employee. Haven is operated by MirrorTab, Inc.
