Bluekit PhaaS Randomized CSS Filter Injection for Pixel-Hash Evasion

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.