Bluekit.cc - all in one phishing kit, 40+ templates, evilginx, voice cloning and more

[petrushka]

Hello!

I'd like to invite anyone interested to try out my new dashboard (actively developed and currently in beta version): bluekit.pk / bluekit.su / bluekit.cc

This dashboard is primarily intended for security researchers (from red teaming sector) and threat actors of course. It was created as an alternative to the popular and well-known Evilginx Pro and all their resellers like Tycoon2FA or EvilProxy.

The main difference is that the service is fully managed by us and has a lower entry barrier. Anyone can purchase a subscription and start using the dashboard right away. There’s no need for ridiculous verification or compromising your privacy just to gain access. You don’t have to be an employee of any company or send us your LinkedIn account.

What exactly do we offer:
   * Ready to use 40+ website templates that are 1:1 as original websites
   * We can add new as quickly as you can request them - just send the url
   * The subscription includes access to ALL available templates - not just one selected
   * Automated domain purchase and registration process - you can buy a domain through our dashboard
   * Fully working 2FA support with emulation and spoofing of geolocation and browser information so the 2FA prompts do not looks suspicious
   * Telegram, in browser native notifications and website "auto refresh" when any new event is detected - you stay updated
   * Advanced antibot cloaking system that you can fully configure so your site stay stealth
   * Not only capturing cookies but also local storage and all keyboard input
   * Everything with anonymity, you can register using Tor Browser and pay via using Monero (XMR)
   * We store minimum data and hash all passwords using Argon2
   * Ability to host your own website files
   * Frequent updates and consideration of customer feedback
   * Bulletproof and decentralized infrastructure
   * Additional features as: ai assistant, vm checker, voice cloning, mail sender and much, much more

Subscription prices:
  7 days - $90
  14 days -> $180 $170
  30 days -> $385 $350

We aim to continuously develop our dashboard with new features, both those we plan ourselves and those you request.
We are also open to collaboration on any other matter requiring technical skills. If you need any software or technical support, simply contact us and we're sure to find a solution.

I believe the dashboard demonstrates my team's capabilities. We are capable of doing anything as long as it brings money.

Feel free to get in touch

telegram: @bluekit_support
session: 053214a694ac2b7e410dcf3b14ed8e0157f1d82718ca4ff71088db81e5c9b57817
jabber: [email protected]

Demo presentation: https://www.youtube.com/watch?v=1svs8r2WBco

[petrushka]

Regarding all questions i got on telegram and to bump this thread a little bit there is changelog from last 2 days:

- We do not work in any of CIS countries. Its illegal of the rules to target any entities with close ties to Russia. A a result, we have implemented a default blacklist that blocks all users from CIS countries. It can be disabled only for testing purposes. We have also removed the option to purchase .ru domains through our control panel. This option was available solely because we had simply listed all the TLDs that our provider allows us to sell.

- Added option to disable captcha before real site to improve integration with iframe

- New templates: credit-agricole.fr, robinhood exchange, labanquepostale.fr and particuliers.sg

- Fixed outlook login detection and makes all outlook sessions full access due to requirement of one time code instead of just a password

- Added option to setup ip/country whitelist instead of just blacklist

- More minor fixes

[petrushka]

Changelog:

- Added new proxy variables: [STATE], [CITY], and [STATE-ISO-CODE] — improve location spoofing accuracy
- Fixed templates on mobile: mobile keyboard no longer stretches the site
- Added SOCKS proxy support
- Fixed Google BotGuard and improved user-agent/location spoofing (select the Stealth option)
- New sites in category static templates: Ledger and Trezor
- New function: Launch Browser (BETA) — run the Mammoth session in a pop-up browser
- Many bug fixes
- Improved site look and quality

 - Minor fixes and polish    

GOOGLE TEMPLATE
Google Template function showcase: 

https://www.youtube.com/watch?v=Lzph7jyp5Gk
New function: Launch Browser (BETA)

This feature lets you open a Mammoth session in a pop-up browser using the same logged-in session,
so you don’t need to worry about fingerprinting, session mismatches or matching IPs.
The pop-up shares the same session and network context where Mammoth is already logged in.
The feature is currently in BETA; if you encounter any errors or bugs, please report them so we can address and fix the issues.

     

TREZOR AND LEDGER TEMPLATE

Ledger showcase 

https://www.youtube.com/watch?v=Yn0Q8f5Mkto 

Trezor showcase 

https://www.youtube.com/watch?v=zo6PROPhUUs

New Template Sites in Category Static Templates: Ledger and Trezor

The Static Templates category includes ready-made template sites, such as Ledger and Trezor. That display seed-related information from Mammoth sessions in a simple, read-only view.
What this gives you:

* Ready templates: prebuilt pages for popular hardware wallets
* Easy seed access: quickly view seed info from your Mammoth session
* Clean design: a simple, clear layout for fast checks

                   

[petrushka]

CHANGELOG

 

- Added new templates: ionos.co.uk ionos.com ionos.es ionos.de

- Added an option to autofill the identifier (email or username) by passing a parameter in the site URL (for example: gmail.bluekit.pk/[email protected]) - and it can be automatically provided and the button to the next step clicked (if there is any)

- Added option to specify own telegram bot token for people that do not want to affiliate our service for business partners

- Added option to connect telegram bot (even without own bot token) to the group and enable logs sending to the group

- Added telegram log about successful login sends also a file with cookies

- Fixed black screen and disconnections on some mobile devices that occurred when switching between application tabs

- Added iframe events for developers that allow to easily integrate our service into iframe:

```

    {

    type: "bluekit_session_event"

    event: "stream_started" | "session_failed" | "disconnected" | "expired" | "error" | "login_detected" | "redirect"

    }

```

- Added a new category of sites FULL-PROXY which allows you to fully mimic pages (for example: Nike or Zalando) and capture any desired information even at checkout. You can set up fully automated fake shops and get all user credentials. It reproduces the entire page and its functionality: product browsing, cart operations, checkout flow, and other interactive elements. THE FULL PAGE    

- Fixed twitter/x   

- More minor fixes

 

Show case x.com (twitter)

https://youtu.be/oV5cEBnOZvE

 

Show case outlook-security

https://youtu.be/N9H-pURF-TE

 

Show case of full site mimic (ZARA shop)

https://www.youtube.com/watch?v=MQQF2vdMmsU

[petrushka]

Changelog
- Added new template sites: amazon.co.jp and HDFC Bank. 
- Fixed issues with the function "launch browser". 
- Added the ability to set a custom title and favicon for templates. 
- Improved the iCloud template. 
- Resolved site stretching on older mobile devices (primarily older Android models). 
- Added/improved a setting to hide the connecting/reconnecting overlay (enable via Settings → Hide connecting). 
- Added support for iGPU to reduce template latency. 
- Added Cloudflare phishing check to the phishing status section. 
- Fixed the captcha-hiding function (allows hiding the captcha before Mammoth enters the template). 
- Improved sorting of Mammoth's logs. 
- Added new payment methods (BTC, LTC, TRX, USDT-TRC20) on dashboard. 
- Minor fixes. 

 

[petrushka]

Changelog
   - Fixed support of iOS devices with system older than 16.4 (now it should work but could be a little laggy because they're really old phones, most of them almost 6 years old and the only way to properly launch our code its by HLS)
   - Fixed detection of safe-browsing ban for some edgy cases
   - Improved Cloaking
   - Added buttons that allow you to download all success hits from all sites/mammoths and also to delete them (also the files) so you do not have to manually visit each victim
   - Added option that allow you to automatically change password and generate back up codes after success hit from Gmail
   - Fixed Apple template
   - Added automatic passkey generation for Gmail.
   - Improved UI/UX of site settings
   - Added new captcha types: Cloudflare & reCAPTCHA
   - Included logs.txt (information about usernames and passwords) in bulk log downloads
   - Minor fixes 

Showcase of Gmail passkey

https://www.youtube.com/watch?v=Jxow5do1zEo   

New Feature: SMS Sender (BETA)
We have added a bulk SMS sending to our dashboard. No third-party tools, as previously. Now you can compose messages (supports setting custom Sender ID) and send bulk SMS up to 500 numbers at once. All in one place. 

Currently we support 13 telecoms across two tiers. We recommend sticking to default ones, as they provides stable delivery rate and lower costs. Experimental tier may vary with delivery rate. you need to test which works best for your use case. Costs are low, you can check them yourself using dedicated button before sending.

                   

[petrushka]

Changelog
- Fixed login detection on iCloud/Apple templates
- Disabled selection of passkey on iCloud/Apple/Amazon/Google/Gmail templates (for the user)
- Added new Gmail-passkey template which enforce user to be logged in into passkey enrollment sub-page and when "Enroll passkey" is enabled in site settings the new passkey should be automatically enrolled. (Auto password changing could be broken right now) 
Please report any issues with gmail-passkey template!
- Gmail template with redirect now redirect the user before redirecting to the final page so it's more stealth
- Hide connecting overlay now also hide information that session expired 
- Increased session expire timeout 
- Fixed sometimes no cookies was sent to telegram after success hit
- Ionos now also detect success login for business account type
- Added ability to setup new servers easier so if you want more servers i.e in USA please reach us
- Fixed copying via mouse right click on PC 
- Added some basic filters for mammoths logs
- Added more buttons that allow to delete useless mammoths logs easier 
- Added ability to setup different telegram bot per site and configure telegram bot notifications settings per site, so it's easier to work in bigger teams now 
- We tested SMS and they're working 100% correctly so we recommend to start sending SMS
- Email sender works too: recommended smtp provider: @whitehorseBHW
- Sidebar now hides automatically after navigation on mobile.
- Improved UI/UX for the mammoth table: overall dashboard appearance enhanced. 
- Fixed missing icon for browser notifications. 
- Reorganized Sidebar.
- Improved safebrowsing phishing detection. 
- Fixed GitHub template.

If you have any questions or something doesn't work as intended, please contact us via Telegram/Session/Jabber (in case we don't answer on Forum)  

[petrushka]

Changelog
- Added Airbnb template
- Added booking & booking partner template
- Added retry system for proxy & allow to specify multiple proxies
- System that allow to be our reseller with custom domain && prices, so please reach us if you want to. We're looking to expand into different markets.
- Amazon security template for Japan Amazon
- Added useragent info back into mammoth subpage & also into downloaded zip 
- Added AtlanticBank template
- Fixed Twitter (x.com) theme detection
- Added pairs.lv template
- Added Telegram notification about safebrowsing ban
- Added Walmart template
- Fixed kucoin & binance template

If you have any questions or something doesn't work as intended, please report it via telegram/session/or on forum! 

[petrushka]

 Changelog
- We completely rewrote our page rendering; it now uses P2P technology, so the main connection to our server is no longer visible in DevTools in any browser. It should work smoother on mobile devices with mobile internet and also older device like iPhone 6S. On WIFI and PC there shouldn't be any difference. The quality gonna be improved in next days.
- Added BNC bank template
- Fixed table responsiveness on PC and it should render cards now on resolutions smaller than HD
- Now captcha support dark mode
- Now Site distinguish identifier and password between other mammoth logs (not fully implemented for all templates) and it should be rendered separately on mammoth sub-page
- Reduced obfuscation to make it more legacy devices friendly
- Fixed ledger and trezor template on mobile devices
- Expired deposit now show all needed information's so it's easier for support to verify broken payments
- Added button that redirect you automatically to specific crypto explorer and allow you to be 100% sure that invoice was paid
- Hide connecting overlay feature now also hide "session expired" information so it should be more stealth
- Fixed custom site title / favicon
- Added lastpass template
- Added evernote template
- Added bnc bank enterprise template (not correctly detect success login but should work)
- Improved UI/UX of dashboard
* Indicate cloudflare status better as "icon" not just text
* Now it doesn't show cloudflare status & nameservers for local domains
* Setup guide
- Improved copy-paste on iOS devices
- Fixed init script
- Fixed "launch browser" - sometimes it didn't worked due to lock in chrome
- Fixed facebook template on mobile devices -> it was displaying black page
- Added amazon automatic change password
- More sms providers
- Added new outlook template

much, much more

latest changelog always on our telegram news channel

t.me/bluekit_news

TUTORIAL HOW TO SETUP

sites.google.com/view/{anything-you-want-here}

best way to spread gmail

https://www.youtube.com/watch?v=rkvKL-g09JE 

[petrushka]

Dear BlueKit Customers,

we will perform scheduled maintenance beginning on Friday to upgrade our infrastructure and deploy a new server environment. These improvements are expected to eliminate the performance issues you may have experienced. 

Subscription time will be paused for the duration of the maintenance: you will not lose any paid time. As compensation, we will add additional time to your current subscription.

Following the upgrade, BlueKit will remain in beta for a few days while we monitor performance and address any issues. After the beta period, subscription price will be set higher.

Changes

- new infrastructure
- new server 

Please join our telegram for more news: 
t.me/bluekit_news

Our onion domain: 
http://bluekitsmi6sd5mjurh3l7n7oeizbedoe2hw2lsljtb5nbxiul6hzkqd.onion/

[petrushka]

Hello BlueKit users,

Our actually domain list:
bluekit.ws
bluekit.su
bluekit.pk (should work as-well) 

TOR (THE MOST STABLE PLEASE SAFE IT!):

http://bluekitsmi6sd5mjurh3l7n7oeizbedoe2hw2lsljtb5nbxiul6hzkqd.onion/ 

it's been 48 hours since launch and everything is running smoothly.
Users are using many templates: The most popular are Google, Amazon, iCloud and Facebook (Meta) templates.

The system appears to be stable, so we are exiting the beta phase.
If any errors appears in other templates, please let us know.

Current pricing:

7 Days - 250$
14 Days - 480$
30 Days - 980$

Changelog from the last 2 days:

- Added automatic proxy configuration: We generate the most optimal proxy for each mammoth using chosen provider. Currently we support RainProxy and IPRoyal. This comes handy as it saves you trouble with configuration and avoids mismatched options.
- Added more mammoth data to XLSX and ZIP exports.
- Added custom favicon and custom title support for sites.
- Added new templates: EQ Bank, TD, SoFi, Tradezero, Questrade.
- Added passkey enrollment and password changing automations for Microsoft (Live security).
- Captcha messages are now more descriptive to help debug issues easier.
- Changing password to dashboard account now causes other sessions to be revoked.
- Fixed issues related to enrolling passkeys.
- Fixed Amazon (Security) 2FA issue where system did not enroll 2FA in certain situations.
- Fixed minor Meta (Facebook) issues.
- Fixed bot detection system as it sometimes blocked real users.
- Fixed issue that was causing clicking some elements, such as ReCaptcha widgets, not work. 
- Fixed WebKit support (Safari/iOS users).
- Improved overall stability of our infrastructure. We can now handle even more traffic.

 

[petrushka]

We have updated our gmail template setup for sites.google.com - it no longer requires custom code. 
Demonstration (how to setup sites.google.com):
https://streamable.com/fv6g9d

how to use gmail passkey showcase:
https://streamable.com/1ww1p2

linkedin template showcase + cookie import:
https://streamable.com/8nbols

Amazon 2fa + passkey showcase (real user):
https://streamable.com/1jojn2

Recent updates:
Implemented improvements to CAPTCHA handling.
Upgraded server infrastructure for improved stability and performance.

24-hour statistics:
948 hits, 6201 users (success hitrate: 15.28%)
The success hitrate depends on your spreading method.

Mostly used templates:
Amazon G-Mail

[petrushka]

Our new domain is bluekit.st.
https://bluekit.st/
https://bluekit.st/dashboard

If possible, please always use our Tor address:
http://bluekitsmi6sd5mjurh3l7n7oeizbedoe2hw2lsljtb5nbxiul6hzkqd.onion/

- BlueKit Team

[petrushka]

Hello, We are thrilled to announce a major update to the BLUEKIT.

What changed: 
- Main Page design has been revamped it looks more fresh and enjoyable now
- Added detailed documentation to guide you through the platform (docs button on dashboard)
- New features include sms sender, HLR Lookup (Currently in Beta, available upon request per telegram) 
- AI Assistant - feel free to ask anything it's uncensored so even phishing prompt will work. 
- Updated our cloaking system - sites are more stealth now.
- Improved infrastructure to load templates quicker

If you face any issues related to our features or do you got some questions left feel free to ask on telegram.

TO FIND OUT WHAT IS OUR ACTUALLY WORKING DASHBOARD DOMAIN VISIT THIS SITE:
BLUEKIT.RS

-BLUEKIT TEAM