A new phishing-as-a-service platform called Bluekit combines more than 40 phishing templates with an AI assistant capable of drafting campaign content, underscoring the growing integration of AI tools into cybercriminal infrastructure.
A newly identified phishing-as-a-service platform called Bluekit offers more than 40 ready-made templates targeting widely used online services and includes an integrated AI assistant designed to help cybercriminals draft phishing campaigns, according to an analysis by cybersecurity company Varonis.
The kit's template library covers a broad range of targets, including email providers such as Outlook, Hotmail, Gmail, Yahoo, and ProtonMail, as well as cloud services like iCloud, developer platforms including GitHub, and cryptocurrency services such as Ledger.
What distinguishes Bluekit from earlier phishing tools is its AI Assistant panel, which supports multiple large language models — among them Llama, GPT-4.1, Claude, Gemini, and DeepSeek — to help operators generate phishing email drafts with less manual effort.
Varonis reviewed a limited version of the AI Assistant panel and found the outputs to be preliminary in nature, with placeholder content throughout. "The draft included a useful structure, but it still depended on generic link fields, placeholder QR blocks, and copy that would need cleanup before use," the firm said. "Bluekit's AI Assistant looked more like a way to generate a campaign skeleton than a finished phishing flow."
Beyond the AI component, the platform consolidates the entire attack lifecycle into one dashboard. Operators can purchase and register domains, configure phishing page behavior, set up redirects, and monitor victim sessions in real time — all from a single interface.
The platform also includes a suite of anti-analysis controls, allowing operators to block traffic from VPN or proxy services, filter out headless user agents, and apply fingerprint-based restrictions to reduce the chance of detection by security researchers.
After a target submits credentials, stolen data is exfiltrated through private Telegram channels accessible only to the operators. Post-capture monitoring tracks cookies, local storage, and live session state, giving attackers a detailed view of what the victim encountered after logging in.
Varonis described Bluekit as an "all-in-one" platform that places fully functional phishing infrastructure within reach of lower-tier cybercriminals who would otherwise lack the technical skills to build such tooling independently.
The platform appears to be under active development, with frequent updates suggesting it is still evolving — a factor that analysts say could accelerate its adoption in criminal communities.
The emergence of Bluekit reflects a broader pattern of cybercrime platforms incorporating AI capabilities to lower operational barriers. Abnormal Security recently documented a separate platform called ATHR, a voice phishing service that uses AI agents to conduct social engineering attacks over phone calls.
As AI tooling becomes more accessible and integrated into off-the-shelf criminal platforms, security teams face growing pressure to adapt detection and response capabilities to threats that can be stood up with minimal expertise and scaled with automated assistance.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →CISA has confirmed active exploitation of CVE-2026-20253, a critical Splunk Enterprise flaw that allows unauthenticated remote attackers to manipulate files, and ordered federal civilian agencies to patch by Sunday under Binding Operational Directive 26-04.
Market intelligence platform Klue has confirmed attackers stole OAuth tokens connected to customer Salesforce environments on June 12, as the newly emerged Icarus extortion group publicly claims responsibility and the list of affected organizations continues to grow.
Human Rights Watch obtained Bulgarian export licensing records showing surveillance firm Circles sold phone-interception and geolocation tools to ten governments — including the UAE, Bahrain, and Azerbaijan — between 2018 and 2023, raising fresh questions about the EU's export control enforcement.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.