Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB researchers identified an active smishing campaign using the reusable JWR phishing kit that impersonates services via urgent SMS links, redirects victims to temporary pages, and streams entered data (card numbers, CVVs, OTPs, passwords) in real time to operators via a WebSocket console (with an HTTP long-poll fallback). The kit’s features — AES-CTR-wrapped messages, a WebSocket token, rotating domains, platform integration markers (WordPress/Shopify), and a long list of IoCs (page names, local storage keys, C2 endpoints, WebSocket paths, YARA/Suricata strings) — enable rapid detection and takedown but also facilitate large-scale, live-fraud attacks that can convert stolen data into immediate financial loss.