Curiouser and Curiouser
Summary: Cisco Talos discovered "JWR," a previously undocumented real-time phishing framework and likely variant of "The Outsider" phishing-as-a-service platform, which uses an open WebSocket connection to let attackers monitor keystrokes live and steer victims through fake checkout and login flows. Deployed via SMS lures impersonating regional toll and postal authorities, JWR lets operators steal payment data, 2FA codes, identity documents, and device fingerprints, and its integration with legitimate e-commerce platforms like Shopify makes the lures convincing.
Why it matters: Because JWR is operator-driven in real time, attackers can prompt victims for 2FA codes exactly when needed and bypass MFA, and stolen device fingerprints and session tokens can defeat conditional access policies.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026