TLDR
AI powered phishing kit BlueKit lets criminals hijack accounts in minutes Researchers at Malwarebytes uncovered BlueKit , a phishing as a service (PhaaS) toolkit sold on Russian language cybercrime forums. The kit bundles a phishing...
How it works
AI powered phishing kit BlueKit lets criminals hijack accounts in minutes Researchers at Malwarebytes uncovered BlueKit , a phishing as a service (PhaaS) toolkit sold on Russian language cybercrime forums. The kit bundles a phishing...
Red flags
- Login pages reached via email/SMS links rather than typing the official URL Slight misspellings or extra subdomains on the address bar (e.g. accounts google support.com ) Urgent prompts for password resets, MFA codes, or seed phrases from "security teams"
What to do
- 1Always navigate to services by typing the domain or using a trusted bookmark
- 2never click email or message links to log in Enable hardware keys or app based MFA and never share one time codes w
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/10/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutesFAQ
Is BlueKit phishing as a service toolkit automates account hijacking on Amazon Google Apple and crypto sites a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Login pages reached via email/SMS links rather than typing the official URL Slight misspellings or extra subdomains on the address bar (e.g. accounts google support.com ) Urgent prompts for password resets, MFA codes, or seed phrases from "security teams"
What should I do first?
Always navigate to services by typing the domain or using a trusted bookmark; never click email or message links to log in Enable hardware keys or app based MFA and never share one time codes w
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.