JWR Phishing Framework Uses Real-Time WebSocket Control and AES Encryption to Steal Banking Credentials
Brief
JWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed.
The campaign uses SMS messages posing as unpaid toll notices, parcel delivery charges, or courier alerts.
A link opens a convincing login page, where the framework collects card details, account credentials, identity documents, and verification codes.
Cisco Talos identified JWR, while security researcher Andrea Fortuna has separately highlighted how phishing can turn a small initial mistake into a much larger compromise. Data can reach an operator before a victim presses submit.
Cisco Talos said in a report shared with Cyber Security News (CSN) that the framework likely has ties to the Chinese-speaking phishing-as-a-service ecosystem known as The Outsider.