Loading malware…
JWR is a reusable, real-time phishing framework used to turn counterfeit payment, banking, login, and checkout pages into operator-controlled fraud sessions. It streams victim form input to an attacker as it is entered, enabling capture of payment-card details, PINs, credentials, one-time passcodes, identity information, document images, cookies, and device-fingerprint data before form submission. Operators can dynamically advance victims through multi-stage workflows, request additional verification or replacement card details after simulated payment failures, and redirect victims after collection.
JWR uses persistent encrypted WebSocket communications for bidirectional interaction between phishing pages and an operator console, with HTTP polling as a fallback. It is designed for reusable deployment across changing brands, domains, and localized lures, including payment, delivery, toll, postal, and account-verification themes. It has also been used in fraudulent e-commerce storefront operations that impersonate established brands and redirect checkout activity to attacker-controlled payment flows.
JWR has been associated with the Outsider operator cluster, which is linked to the broader Smishing Triad phishing-as-a-service ecosystem. Delivery has primarily occurred through SMS phishing campaigns using urgent unpaid-toll, parcel-fee, delivery, and account-verification lures, as well as through deceptive e-commerce advertising. Activity has affected victims across multiple countries, including campaigns targeting Southeast Asia and the Middle East.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Le kit JWR (JWR phishing kit) est un outil de phishing réutilisable attribué au cluster opérateur Outsider, rattaché à l’écosystème Smishing Triad. Il transforme de fausses pages de paiement en consoles de fraude bidirectionnelles grâce à une connexion WebSocket persistante.
Le kit JWR (JWR phishing kit) est un outil de phishing réutilisable attribué au cluster opérateur Outsider, rattaché à l’écosystème Smishing Triad. Il transforme de fausses pages de paiement en consoles de fraude bidirectionnelles grâce à une connexion WebSocket persistante.
JWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Next, it initializes the communication channel, captures the victim's action, and creates a CVV form with the victim's device fingerprint data. This includes the victim's current form of state, such as device type, browser, language, time zone, and geolocation, which are encrypted and sent to the actor's C2 server.
“JWR is a phishing framework capable of harvesting complete payment card data, login credentials, and personally identifiable information (PII) documents and images in real time.”
Regardless of which of these three modes or through the Host Bridge is used, the data is either sent to C2 as plain text in JSON format with the DEV_MODE flag set, or it is passed to the JwrCrypto module, which encrypts it with a newly generated key before sending it to the C2 server.
The framework includes templates that imitate payment, shopping, and bank services, and can rebuild product details from a shopping cart.
The same underlying code can sit behind different brand skins, while operators rotate short links and domains quickly.
The host bridge incorporates an anti-analysis check, which serves as a one-time execution guard that performs a self-referential .toString().search() call against a backtracking regex. This check detects whether a debugger has attached the function to modify its apparent source.
Its code sends updated form data whenever a watched field changes, meaning card numbers, security codes, and OTPs can reach the fraud team before a victim presses submit.
Next, it initializes the communication channel, captures the victim's action, and creates a CVV form with the victim's device fingerprint data. This includes the victim's current form of state, such as device type, browser, language, time zone, and geolocation
The host bridge incorporates an anti-analysis check, which serves as a one-time execution guard that performs a self-referential .toString().search() call against a backtracking regex. This check detects whether a debugger has attached the function to modify its apparent source.
For the victim’s environments where a persistent WebSocket connection is unavailable or blocked, api/open/pollInstruction provides an HTTP long poll fallback that delivers the same operator instruction objects the socket would otherwise push.
JWR uses a persistent WebSocket connection for continuous exchanges with a server. Its client encrypts traffic with AES-CTR, helping obscure the exchange while an operator controls each stage of a fraudulent session in real time.
A persistent WebSocket connection carries instructions between the phishing page and the criminal panel. If it fails, the kit falls back to repeated web requests every two seconds.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A reusable, real-time smishing phishing kit that serves branded payment, delivery, and account-verification lures. It exfiltrates card data, bank credentials, identity details, PINs, and SMS OTPs as victims enter them, allowing operators to dynamically advance or alter the fraud workflow. It uses WebSocket C2 with a two-second HTTP long-poll fallback and AES-256-CTR-wrapped traffic.
Reusable, real-time SMS-phishing kit that harvests identity data, payment-card details, bank credentials, PINs, and one-time passcodes. It streams victim form input to an operator console over WebSockets, with two-second HTTP long-polling as fallback, enabling operators to dynamically advance victims through fraud flows and conduct account takeover or unauthorized payments.
Reusable smishing phishing kit that presents fraudulent payment, banking, and account-verification pages. It streams victim-entered payment-card data, banking credentials, OTP/2FA codes, and identity information to operators in real time over persistent WebSockets, with HTTP polling fallback. It supports operator-guided, multi-step victim flows and rotates domains/short links to evade blocking.
A real-time phishing kit used in fraudulent Shopify storefronts. It intercepts checkout activity and presents attacker-controlled payment pages to capture card data, payment credentials, OTPs, and identity information across multiple payment methods.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.