A 32 kilobyte blob came back from a phishing server with no file magic, no compression header and uniformly high entropy across every byte. It looked like a dead end. It took three lines of Python, because the criminals who built the kit wrapped each message in AES encryption and then shipped the key inside the message.
That finding sits at the centre of a teardown published on 14 September by Group-IB's Mohammad Gamal Younis, who reverse engineered a phishing kit called JWR and the operator crew running it. The full walkthrough is in the original report.
Encryption that protects nobody
Every request the kit sends to its server, and every frame on its WebSocket channel, uses one envelope: 32 bytes of AES-256 key, then 16 bytes of counter, then the ciphertext of a JSON document. The key is random for each message and it travels in clear at the front of the packet. There is no key exchange and no shared secret, so anyone holding the traffic can read it.
Group-IB reads the design as an attempt to defeat casual logging rather than real interception. A proxy log or a packet capture of this traffic shows binary rather than card numbers, and an analyst skimming for JSON strings finds nothing. The cost to the criminals is that the 48 byte header is a fixed shape, which makes both detection and decryption straightforward for anyone who knows to look.
What the operators switch on
Decrypting one captured configuration response exposed the settings the crew runs each deployment with: a Luhn check that validates card numbers as they are typed, an unattended mode for sessions nobody is watching, toggles that push a fake card rejection to make the victim hand over a second card, and BIN lists deciding which card issuers are worth the effort.
The kit is not new to this site. Cisco Talos documented the same family in August, showing how an operator watches a victim type and steers them page by page. Group-IB's contribution is the wire format, the attribution and the detection material.
Fingerprints the developer left behind
Several are durable. The WebSocket URL ends in a hardcoded access token, khkjsahfjkwhakjlsdwdddddd88, present in every build recovered. Per victim identifiers carry a JWRCVV prefix. A misspelled page name, i_payal_select_verify.html, is baked into the operator panel's instruction tables and survives across campaigns. The kit's field validator library covers a dozen jurisdictions, and the co-occurrence of personnummer, fodselsnummer, codicefiscale and germanid in one bundle is, Group-IB says, unique to this family. Build strings also reference a codebase known in operator circles as trsb[.]top.
Group-IB attributes this deployment to a cluster it tracks as Outsider, a customer of the wider smishing-as-a-service market known as the Smishing Triad rather than an independent operator. It separates the crew by the brands it impersonates, by operator-only status strings written in Simplified Chinese, and by hosting tradecraft: a Hong Kong registrar, United States cloud nameservers, and domains that mostly live two days or less. We covered the same cluster earlier this month when it put up more than 700 new pages after a takedown.
One detail widens the target list. The kit checks for markers left by Shopify and WordPress and, when it finds them, switches into a host platform path that calls WooCommerce's own order completion endpoint. It ships as a hostile plugin or theme injection, not only as standalone phishing pages.
Hunt the token, then decrypt the capture
Group-IB published a Suricata rule matching the WebSocket path together with its access token, and a YARA rule for the JavaScript bundle keyed on strings including that token, the JWRCVV prefix and the misspelled PayPal page. Defenders sitting on packet captures of suspected JWR traffic do not need anybody's cooperation to read them, because the key is in the first 32 bytes. The kit's REST calls sit under an /api/open/ path, with a two second long poll asking the server for pending operator instructions.
Group-IB places the wider Triad ecosystem at well over 194,000 malicious domains since 2024 spanning 121 or more countries, citing public reporting from Silent Push, Palo Alto Unit 42, Resecurity and Fortra. The kit's data model carries three separate web login slots, which Group-IB reads as bank to bank to brokerage chaining inside a single session. The crews are not stopping at a card number.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.