JWR Phishing Framework Leverages Real-Time Session Steering via WebSockets

Cisco Talos researchers have uncovered a new, sophisticated phishing framework internally dubbed "JWR." This platform is designed to convincingly impersonate the login and checkout pages of major payment processors and online retailers. Unlike traditional phishing kits that merely capture form submissions, JWR employs a real-time, operator-driven approach. Its client engine maintains an encrypted WebSocket connection with the threat actor, enabling them to steer each victim's session live.

The scope of data exfiltration by JWR is extensive, going beyond typical payment card details. Threat actors using this framework target a wide array of sensitive information, including identity documents such as passport and driver's license images, Social Security numbers, full payment card data (including CVV and PIN), website and PayPal credentials, two-factor authentication codes, and comprehensive device fingerprints. All collected data is transmitted to the actor's server upon session completion.

Talos assesses with medium confidence that the JWR framework is a variant of "The Outsider," a known phishing-as-a-service (PhaaS) platform. This assessment is based on significant similarities observed in the client engine scripts and functionalities between JWR and The Outsider. The Outsider platform has been previously attributed to a Chinese-speaking threat actor known as "Outsider Enterprise."

In observed real-world campaigns, JWR has been deployed using SMS lures. These messages often impersonate legitimate entities such as toll authorities, postal services, and courier companies, targeting individuals in Southeast Asia and the Middle East. This multi-vector approach, combining sophisticated technical capabilities with social engineering, highlights the evolving threat landscape of phishing operations.

The JWR client engine architecture is notably complex, featuring a Host Bridge module and a Vue.js victim application. The Host Bridge operates within the parent phishing page, relaying commands to a child iframe containing the actual phishing form, while establishing the persistent WebSocket connection to the command-and-control (C2) server. The Vue.js application, on the other hand, manages the interactive front end, renders the phishing pages, collects victim input across numerous HTML files, and processes instructions from the C2.

Communication between the client engine and the C2 server can occur in several modes: standalone, pluginIframe, and hostIframe. Regardless of the mode, data is either sent as plain text or encrypted using the JwrCrypto module before transmission. A background worker module ensures the C2 connection remains active throughout the session, independent of page navigation. During a live session, the script continuously streams the victim's keystrokes to the actor's C2 server, while the actor can send real-time instructions to manipulate the victim's experience, such as redirecting them to different pages or updating the current page's status.

This real-time interaction capability allows threat actors to dynamically adapt their phishing tactics based on victim engagement, potentially increasing the success rate of credential and data harvesting. The framework's ability to collect such a broad spectrum of personal and financial data, combined with its advanced session steering mechanism, positions JWR as a significant threat to individuals and organizations alike.