At one point in time, the phishing kit market was specialized. Operators bought a credential-harvesting page from one seller, a domain rotator from another, and an SMS gateway from a third. Then they stitched the rest together on their own infrastructure.
Varonis Threat Labs recently discovered Bluekit, a new phishing kit pitching a broader model. It advertises 40+ website templates, automated domain purchase and registration, 2FA support, spoofing, geolocation emulation, Telegram and browser notifications, antibot cloaking, and add-ons like an AI assistant, voice cloning, and a mail sender.
The templates we reviewed covered email and cloud accounts, developer platforms, social media, retail, and crypto services, including iCloud, Apple ID, Gmail, Outlook, Hotmail, Yahoo, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger.
Some of the templates Bluekit supports.
Some of the templates Bluekit supports.
What Bluekit ships in one panel
To see how that held up in practice, we obtained access to Bluekit and reviewed the kit from the inside. That gave us a closer look at the operator dashboard, the site-creation flow, the post-capture panels, and the AI Assistant.
Bluekit pulls several parts of the phishing workflow into one place. The panel covers site creation, domain setup, captured logs, delivery tooling, and campaign support features, with Telegram wired in as the default exfiltration channel.
The Bluekit dashboard showing the main operator panel.
The Bluekit dashboard showing the main operator panel.
Operators can buy or connect domains from the same interface used to manage phishing pages and captured logs, rather than splitting that work across separate services.
That setup flow also extends into site creation itself. In the view we reviewed, operators could pick a domain, choose a mode, and select from a broad list of target brands and services, including consumer email providers and developer-facing platforms.
The Site-creation flow with domain, mode, and template selection.
The Site-creation flow with domain, mode, and template selection.
Bluekit also exposes fairly granular control over how a site behaves once it is live. In the site-edit view we reviewed, the kit exposed login-detection actions, redirect behavior, anti-analysis checks, spoofing options, and device filters from the same configuration panel.
Optional site-level controls for redirects, spoofing, and anti-analysis checks.
Optional site-level controls for redirects, spoofing, and anti-analysis checks.
Those configuration views also exposed proxy settings and site-level checks tied to how sessions were handled after login. That gives the operator more control over what happens once a target leaves the phishing page.
In the Mammoth Details view we reviewed, Bluekit tracked session state, stored repeated dumps of cookies and local storage, and kept a live view of what the target saw after login. That shows the kit is handling more than a basic credential grab, with the panel also surfacing session data after login.
The target details view with session state and browser-storage dumps.
The target details view with session state and browser-storage dumps.
The AI Assistant under the hood
We were especially interested in the AI component. Inside Bluekit, the AI Assistant has its own panel and exposes multiple model options, including an abliterated Llama default alongside GPT-4.1, Claude Sonnet 4, Gemini, and DeepSeek variants.
In our testing, we were only able to use the default abliterated Llama model. The commercial options appeared in the interface, but they required additional configuration we did not have.
Even so, their presence is still notable. If those models are usable in practice, they are likely being accessed through jailbroken or otherwise permissive instances, because a standard setup would be more likely to block or censor this kind of output.
The model selector inside Bluekit’s AI Assistant.
The model selector inside Bluekit’s AI Assistant.
We used a detailed campaign brief built around an executive phishing scenario: a Microsoft 365 MFA re-verification lure aimed at the CISO of "BlueKit Software," with a branded QR code, a polished email delivery path, and a credential-harvesting login page as the end goal.
A prompt-and-response view from the AI Assistant test.
A prompt-and-response view from the AI Assistant test.
We expected something closer to a polished phishing copilot: a finished lure, cleaner email copy, and perhaps even a workable QR-driven flow with less manual effort. What we received was much more limited. The assistant returned a structured campaign draft, and much of it relied on placeholders instead of content that looked ready to use as-is.
The AI output relying on placeholders and generic scaffolding.
The AI output relying on placeholders and generic scaffolding.
In close-up, the limitation is easier to see. The draft included a useful structure, but it still depended on generic link fields, placeholder QR blocks, and copy that would need cleanup before use. Bluekit’s AI Assistant looked more like a way to generate a campaign skeleton than a finished phishing flow.
Where Bluekit fits in the ecosystem
Bluekit has been on our radar for a while. Early on, part of the goal was to see whether we could catch the kit in a live campaign. Over time, though, the release cadence became part of the story. The developer kept shipping new features and adding templates quickly enough that keeping up with the changes became just as important as waiting for a single live sample.
A recent changelog entry showing the pace of feature updates.
A recent changelog entry showing the pace of feature updates.
Compared with similar phishing kits that have already advanced further into automation and operator convenience, Bluekit still appears to be a kit in active development. The feature set keeps evolving as we track it, and if that pace continues with broader adoption, Bluekit is likely to surface in future campaigns.
Stay up to date on the threat landscape by following Varonis Threat Labs.
.png)
