Malwarebytes reports that BlueKit helps criminals build fake login pages and scam messages quickly. Check unexpected sign-in requests through the official app or a saved bookmark, not the message link.
In 60 seconds
- People using personal or work accounts should care about more convincing login scams.
- Check unexpected sign-in requests in the official app or through a saved bookmark.
- Do not enter passwords, passkeys, or security codes after opening an unexpected message link.
- If you entered details, change the password through the real site and review account activity.
Who should care and what to do today
This matters to people who receive email or text messages about account warnings, payments, deliveries, files, or sign-ins. Malwarebytes reports that BlueKit includes templates for consumer services, financial and cryptocurrency services, social media and communications, artificial intelligence services, and business services.
If a message asks you to sign in, do not use its link. Open the service’s official app or type its known web address yourself. A saved bookmark is also a useful option.
Do not download a tool, call a number, or reply with a password or security code just because the message looks polished. Check the account through a separate route first.
Why these scams may look more believable
Malwarebytes describes BlueKit as a phishing-as-a-service toolkit. That means criminals can rent ready-made tools for running fake-login campaigns instead of building everything themselves.
The report says BlueKit offered 97 brands across 176 template variants as of September. It also says the service can target personal accounts and business systems, including single sign-on gateways. Single sign-on, or SSO, is one shared sign-in page used to reach several work services.
The service includes an artificial intelligence assistant that its operators advertise for writing scam emails and text messages. Malwarebytes also reports that the operators added a text-message sender and said it could use local United States phone numbers.
The practical point is simple: correct spelling, familiar logos, and a personal-sounding message do not prove that a login page is genuine.
What can happen after a fake login
The risk is not limited to someone learning your password. Malwarebytes says BlueKit can collect information about the device and browser, session cookies, and passkeys. A session cookie is a small file that tells a website you have already signed in, so you do not need to enter your password on every page.
If a scammer obtains that active sign-in token, the report says the attacker may be able to enter an account without asking for the password or a two-step code again. Keep two-step sign-in enabled, but do not treat it as a reason to trust an unexpected login link.
If you signed in through a suspicious link, go to the real service using its app or a saved bookmark. Change the password, review recent account activity, and sign out of all sessions. For an account managed by an organization, tell the person responsible for that account promptly.
General guidance for checking a login request
Look closely at the web address, but do not rely on appearance alone. Scam pages can use addresses with small spelling changes or extra words. A password manager may refuse to fill a login on the wrong site, which can be a useful warning.
Treat an unexpected request as untrusted even when it uses a familiar brand or asks you to fix an urgent problem. Open the service yourself and look for the same notice there.
Malwarebytes’ report describes BlueKit and its advertised capabilities. It does not say that a particular reader received a BlueKit message or that a specific account was compromised.
Does this affect me?
- Who may be affected
- People who use online consumer, financial, cryptocurrency, social, artificial intelligence, or business services should care about this report.
- How to check
- Look for unexpected messages asking you to sign in, fix an account, approve a payment, or open a file. Check the claim through the service’s official app or a saved bookmark instead of the message link.
- What to do
- Use the official app or known website for account checks, keep two-step sign-in enabled, and review account activity after any suspicious login.
- What to avoid
- Do not enter passwords, passkeys, or security codes on a page opened from an unexpected email or text, and do not install software at the sender’s request.
Common questions
Does this mean my account was attacked by BlueKit?
No. Malwarebytes’ report describes BlueKit as a criminal phishing service and explains its capabilities. It does not say that a particular reader received a BlueKit message or that a specific account was compromised.
Can two-step sign-in stop these scams?
It adds an important layer of protection, but Malwarebytes says BlueKit can capture active sign-in sessions after a person logs in. Keep it enabled and still avoid login links in unexpected messages.
What if I already entered my password on a suspicious page?
Open the real service through its app or a saved bookmark. Change the password, review recent activity, and sign out of all sessions. Tell the person responsible for the account if it is managed by an organization.
What services does the report say BlueKit can imitate?
Malwarebytes reports templates for consumer, financial, cryptocurrency, social media and communications, artificial intelligence, and business services. It names examples including Google, Apple, American Express, GitHub, Salesforce, and security services.
Primary source
This article is based on Malwarebytes Labs’ report, “AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes,” published October 7, 2026: https://www.malwarebytes.com/blog/threat-intel/2026/10/ai-powered-phishkit-arms-criminals-with-account-hijacking-tools-in-10-minutes. The report is the source for the claims about BlueKit and its advertised capabilities. The account-checking steps are general guidance. Read the complete original source.
Get the important updates without the noise
Choose the devices and topics you care about in Cyber Alerts.
Article history: Published Oct 7, 2026 at 7:41 am EDT. Updates and corrections are noted here when material facts change.
