Cisco Talos has taken apart a previously undocumented phishing kit that does something an ordinary fake login page cannot: it lets a criminal watch a victim fill in the form, in real time, and decide what to ask for next.
The framework is branded "JWR" by its own developer, and it builds convincing replicas of checkout and login flows for major payment and shopping brands, including Shopify, PayPal, Apple, Klarna and banks. A normal credential-stealing page logs whatever gets submitted and stops there. JWR instead keeps an encrypted WebSocket, a live two-way connection between the browser and the attacker's server, open for the whole session, so a human operator can drive the victim step by step.
What the operator sees
Talos researcher Chetan Raghuprasad found that the kit streams the victim's keystrokes to the attacker's console as they are typed, exposing partial card numbers, passwords and verification codes before the victim clicks anything. The operator can then issue more than 40 commands, each mapped to one of 44 phishing pages: to_card moves the victim to a card entry form, to_sms or to_2fa demands a one-time code, and tip_change_card pushes a fake "your card was declined" message to make the victim hand over a second card. That loop can run as many times as the operator wants.
What the kit collects goes well past payment data. Talos documented an exfiltration record holding full name, date of birth, Social Security number, passport and driver's license images, medical record number, address, email password, up to three sets of website logins, PayPal credentials, complete card data including the PIN, photos of the front and back of the card, and an automatically captured browser fingerprint covering IP address, device, language, time zone and geolocation.
Who is behind it
Talos assesses with medium confidence that JWR is a variant of "The Outsider", a phishing-as-a-service platform that other researchers have attributed to a Chinese-speaking actor, based on shared code and functionality between the two client engines. The operator-facing status messages inside JWR are written entirely in Simplified Chinese and read like a professional admin dashboard, with lines such as "filling in PayPal login account" and "entering 2FA verification page".
Talos also observed a live campaign delivering the JWR client through SMS lures impersonating toll authorities and postal and courier services in several countries across Southeast Asia and the Middle East. Kits like this are increasingly a service business rather than a one-off scam, as with the phishing platform that survives Microsoft 365 password resets and the bulk SMS services that drop those lures into genuine bank message threads.
What you should do
Treat any payment or login page you reached from a text message as hostile, and go to the merchant or your bank yourself instead of following the link. For defenders, the tells are specific: a checkout page opening a WebSocket to a host unrelated to the merchant, and, where sockets are blocked, HTTP long polling against the paths api/open/addClick, api/open/getSyncSettings, api/open/pollInstruction and api/open/the_final_interface. JWR also reads Shopify's signed cart_data parameter to rebuild the victim's real basket and to anchor its socket to the legitimate checkout domain, which makes the fake page look right and its traffic look local. The full deobfuscated analysis is in the original report from Cisco Talos.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.