Curiouser and Curiouser

Talos' weekly briefing highlights a newly disclosed real-time phishing framework called JWR that uses WebSocket connections to capture keystrokes and steer victims through fake flows—enabling theft of payment data, 2FA codes, identity documents and potential MFA bypass—alongside coverage of active incidents including a ransomware attack on Colombia’s Justice Ministry, a large Ceva Logistics data breach, a SharePoint JWT exploitation in the wild, and several malware samples with hashes and detections; recommended actions include smishing awareness, monitoring for unusual authentications, and adoption of phishing-resistant MFA like FIDO2 keys.