02-09-2026
BlueKit PhaaS in the Wild: BitM, Geofencing, and ScreenConnect Post-Exploitation
https://zerobec.com/blog/bluekit-phaas-browser-in-the-middle-screenconnect
Report completeness: High
Threats:
Bluekit_tool
Bitm_technique
Screenconnect_tool
Cloaking_technique
Zerobot
Aitm_technique
Tycoon_2fa
Greatness_tool
Forg365_tool
Residential_proxy_technique
Device_code_phishing_technique
Bec_technique
Victims:
Financial services groups, Chief executives of financial services groups, Asset management, Investment banking, Wealth advisory, Financial technology
Industry:
Financial
Geo:
Israel, New_york, United states, Indian, Ukraine, America, India, Kazakhstan, Romania, Uzbekistan, Israeli
TTPs:
Tactics: 2
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1027, T1036, T1071.001, T1090.002, T1185, T1219, T1497.001, T1539, T1550.004, T1557, have more...
IOCs:
File: 4
Domain: 6
Url: 7
Hash: 7
Soft:
Telegram, Microsoft browser, WebRTC, Chromium, Outlook, Microsoft Entra, Dropbox
Algorithms:
deflate, aes-gcm, sha256, base64, aes
Languages:
php, javascript
Platforms:
x86
