Full Report
Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms.
Analysis Summary
# Tool/Technique: JWR Phishing Framework
## Overview
JWR is a sophisticated, undocumented phishing framework (likely a variant of "The Outsider" PhaaS) designed for real-time, operator-driven credential and financial data theft. Unlike static phishing pages, JWR uses an interactive client engine that allows a live threat actor to "steer" a victim's session, bypass 2FA, and capture sensitive PII through a persistent encrypted WebSocket connection.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) Framework / Malware Tool
- **Platform:** Web-based (Cross-platform browsers), targeting mobile and desktop users.
- **Capabilities:** Real-time keystroke logging, 2FA interception, PII/document harvesting (IDs/Passports), device fingerprinting, and AES-encrypted C2 communication.
- **First Seen:** Identified as active in campaigns around June–August 2026 (building on lineages dating back to 2023).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (SMS/Smishing lures)
- **[TA0007 - Discovery]**
- [T1204.002 - User Execution: Malicious Link]
- [T1657 - Financial Discovery]
- **[TA0009 - Collection]**
- [T1056.001 - Input Capture: Keylogging]
- [T1185 - Browser Session Hijack] (Adversary-in-the-Middle/Live steering)
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols] (WebSockets)
- [T1573.001 - Encrypted Channel: Symmetric Cryptography] (AES-CTR)
## Functionality
### Core Capabilities
- **Live Session Steering:** Operators can send over 40 distinct instructions to the victim's browser in real-time.
- **Multi-Brand Impersonation:** Includes 44 phishing pages mimicking Shopify, PayPal, Apple, Klarna, and various international banks/postal services.
- **Persistent Connection:** Uses a background worker module to maintain the WebSocket connection even during page navigation.
- **Data Exfiltration:** Captures "cvvform" objects (CC numbers, CVV, PIN, expiry) and website credentials.
### Advanced Features
- **Real-time Keystroke Streaming:** Victims' inputs are sent to the C2 as they are typed, before form submission.
- **Encrypted Communication:** Uses a custom `JwrCrypto` module for AES-CTR encryption of data packets.
- **PII Image Capture:** Prompts victims to upload photos of Social Security cards, Passports, and Driver’s Licenses.
- **Adaptive Execution Modes:** Can run in "Host Mode" (relay bridge) or "Content Mode" (Vue.js application) depending on the environment.
## Indicators of Compromise
- **File Names:** `JwrCrypto`, `Host Bridge`, `cvvform` (Internal module/object names).
- **Network Indicators:**
- Communications via WebSockets (wss://).
- Use of AES-CTR encrypted JSON payloads.
- Phishing domains often impersonate toll authorities and courier services (e.g., Southeast Asia/Middle East regions).
- **Behavioral Indicators:**
- High volume of small WebSocket messages (keystroke streaming).
- Use of `window.__HOST_MODE` global flags in browser scripts.
## Associated Threat Actors
- **Outsider Enterprise:** A Chinese-speaking threat actor group (JWR is assessed as a variant of their "Outsider" platform).
## Detection Methods
- **Signature-based:**
- ClamAV: `Js.Phishing.JwrFramework-10060456-0`
- Snort SIDs: 66924, 66925, 66926, 66927, 66928.
- **Behavioral:** Monitoring for unusual persistent WebSocket connections from checkout-style pages to non-standard domains.
- **Heuristics:** Detection of Vue.js applications embedded in iframes designed to mirror legitimate payment gateways.
## Mitigation Strategies
- **User Education:** Train users to identify "Smishing" (SMS phishing) and verify URL authenticity before entering payment data.
- **FIDO2/WebAuthn:** Implement hardware-based MFA which is resistant to the real-time proxy/steering techniques used by JWR.
- **Network Filtering:** Block known malicious domains and use web reputation filtering to flag newly registered domains (NRDs).
## Related Tools/Techniques
- **The Outsider:** The parent PhaaS platform.
- **Lucid / Darcula / Lighthouse:** Other Chinese-speaking PhaaS ecosystems (share behavioral similarities but different codebases).
- **Adversary-in-the-Middle (AiTM):** General technique used by JWR to intercept session data.