Bluekit BitM rrweb DOM Streaming WebSocket Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects anomalous WebSocket connections that transmit DOM serialization data using the rrweb library. This activity is indicative of a Browser-in-the-Middle (BitM) phishing framework, where an attacker records and relays a live, authenticated browser session from a victim to an adversary-controlled server.