BlueKit PhaaS in the Wild: BitM, Geofencing, and ScreenConnect Post-Exploitation

A sophisticated, targeted phishing campaign leveraged BlueKit Phishing-as-a-Service to compromise financial sector CEOs by chaining victim-branded PDF lures, advanced cloaking, browser-in-the-middle Microsoft credential theft, regional proxy evasion, and post-login delivery of legitimate ScreenConnect remote access tools for full endpoint compromise.