Dissecting the JWR phishing framework

Cisco Talos identified and analyzed JWR, an undocumented, operator-driven phishing framework (likely a variant of the Outsider PhaaS) that impersonates checkout/login flows across major platforms and streams victims' keystrokes and submitted data in near real time via an AES-CTR encrypted WebSocket; the kit harvests full card data, PII, credentials, 2FA codes and device fingerprints, integrates with Shopify/WooCommerce to appear legitimate, is delivered via SMS smishing in Southeast Asia and the Middle East, and includes detailed C2 endpoints, operator instruction mappings, IOCs and detection signatures.