New Phishing Kit Gives Threat Actors Live View Into Attacks

Cisco Talos researchers describe a phishing framework called “JWR” that livestreams victim interactions to attackers via an AES-CTR encrypted WebSocket, enabling real-time steering of login and checkout flows to harvest complete payment card data, credentials, PII (including SSNs and ID images), and 2FA codes. The platform is being used in widespread SMS phishing (smishing) campaigns impersonating national transport authorities, postal services, and regional courier brands across multiple countries to deceive victims with unpaid-toll and undelivered-parcel lures; Cisco Talos provides a detailed analysis at their blog.