Full Report
In this edition of the Threat Source newsletter, William reflects on the “Make Hazel a Hacker” segment in Beers with Talos, and how cybersecurity is a field where questions can lead to multiple correct answers.
Analysis Summary
# Morning News Roll-up August 13, 2026
## Overview
This edition focuses on the emergence of the "JWR" real-time phishing framework, a sophisticated tool for bypassing multi-factor authentication, and explores the importance of diverse perspectives in threat hunting.
## Top Stories
### JWR: A New Real-Time Phishing-as-a-Service Framework
- Summary: Cisco Talos discovered "JWR," a real-time phishing framework and variant of "The Outsider." It uses WebSockets to allow attackers to monitor victim keystrokes live and dynamically steer them through fake checkout flows to steal 2FA codes and payment data.
- Source: hxxps://blog[.]talosintelligence[.]com/dissecting-the-jwr-phishing-framework
### Ransomware Disrupts Colombian Justice Ministry
- Summary: A ransomware attack hit the Colombian Justice Ministry just before a presidential transition, impacting drug monitoring and legal processes. This follows recent warnings from Colombia's national CERT regarding increased ransomware activity in the region.
- Source: hxxps://www[.]darkreading[.]com/cyberattacks-data-breaches/ransomware-hits-colombian-justice-ministry-presidential-transition
### FBI Investigates North Korean Remote IT Workers
- Summary: The FBI is investigating a case where a North Korean remote IT staffer was found working for a U.S. government agency. This highlights a growing trend of North Korean nationals using fraudulent identities to gain employment in Western tech and government sectors to generate revenue or gain access.
- Source: hxxps://blog[.]talosintelligence[.]com/
---
# Main Topic
Analysis of the **JWR Phishing Framework**, a real-time "Phishing-as-a-Service" (PhaaS) platform designed for live operator intervention to bypass security measures and harvest comprehensive identity profiles.
## Key Points
- **Live Operator Interaction:** Unlike static phishing kits, JWR uses an open WebSocket connection, allowing threat actors to monitor victim activity in real-time.
- **Dynamic Steering:** Operators can manually prompt victims for specific information, such as 2FA codes or identity documents, exactly when they are needed to bypass security.
- **Convincing Decoys:** The framework integrates seamlessly with legitimate e-commerce looks (like Shopify) to impersonate regional toll and postal authorities.
- **Data Harvesting:** Beyond credentials, the tool steals device fingerprints and session tokens, which can be used to bypass conditional access policies later.
## Threat Actors
- **Attribution:** Unknown, but the tool is identified as a likely variant of **"The Outsider"** phishing-as-a-service platform.
- **Motivations:** Financial gain through the theft of payment data, and long-term access via identity document and credential theft.
## TTPs
- **Smishing Lures:** SMS messages impersonating postal services or toll authorities.
- **Real-Time Interception:** Use of WebSockets for live keystroke monitoring.
- **Adversary-in-the-Middle (AiTM):** Dynamically requesting 2FA/MFA codes to bypass authentication in real-time.
- **Social Engineering:** Mimicking Shopify and other e-commerce interfaces to build trust during the "checkout" process.
## Affected Systems
- **Victim Demands:** Users of regional toll and postal services.
- **Technologies:** Mobile devices (via SMS), e-commerce platforms (Shopify-style lures), and accounts protected by non-phishing-resistant MFA.
- **Impact:** Compromised payment cards, stolen 2FA codes, and compromised device fingerprints.
## Mitigations
- **User Education:** Train users to identify "smishing" lures, particularly regarding unsolicited delivery or toll fee notifications.
- **Phishing-Resistant MFA:** Implement hardware-based authentication like **FIDO2/WebAuthn** to prevent AiTM interception of codes.
- **Conditional Access Monitoring:** Monitor for unusual authentication attempts using stolen session tokens or unexpected device fingerprints.
- **Technical Indicators:** Review Talos telemetry for prevalent malware hashes associated with broader campaigns.
## Conclusion
The JWR framework represents a significant shift toward manual, operator-driven phishing that renders traditional 2FA methods (like SMS or App-based OTP) ineffective. Organizations must shift toward phishing-resistant MFA and improve real-time monitoring of authentication anomalies to counter these dynamic threats. Collaborative threat hunting—utilizing diverse perspectives as highlighted in the "Make Hazel a Hacker" segment—remains essential for identifying subtle indicators like unusual file pivots (e.g., "wallpaper.bmp").