Dissecting the JWR phishing framework
Summary: Cisco Talos detailed JWR, a phishing framework whose client engine impersonates checkout and login flows for Shopify, PayPal, Apple, Klarna and banks, streaming victim keystrokes to operators over an AES-CTR encrypted WebSocket channel. The engine renders 44 phishing pages, executes more than 40 distinct C2 instructions, and exfiltrates a cvvform object covering card number, CVV, PIN, SSN, passport and ID images, 2FA codes, PayPal credentials and device fingerprint, with Talos finding significant code overlap with The Outsider PhaaS platform run by the Chinese-speaking actor "Outsider Enterprise."
What you should know: The kit streams partial card numbers, passwords and verification codes to the operator as they are typed, before any submit button is pressed, so a victim who abandons the form mid-entry has still handed over the data.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026