A previously undocumented phishing framework, internally dubbed "JWR" by its developers, has been identified as a real-time, operator-driven system designed to impersonate checkout and login pages for major payment and shopping platforms. Cybersecurity researchers at Cisco Talos discovered the framework, noting its capability to harvest extensive victim data, including payment card details, login credentials, personally identifiable information (PII) documents and images, and even two-factor authentication (2FA) codes.
Unlike static credential-stealing pages, JWR maintains an AES-CTR encrypted WebSocket connection to the threat actor, allowing for live, interactive control over each victim's session. This enables the actor to steer the victim through various phishing pages and collect data as it is entered. The targeted data encompasses credit card numbers, CVVs, PINs, expiry dates, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints. All collected data is committed to the actor's server upon session termination.
Talos assesses with medium confidence that JWR is a variant of "The Outsider," a phishing-as-a-service (PhaaS) platform operated by the Chinese-speaking group "Outsider Enterprise." This assessment is based on significant code and functional similarities observed in the client engines of both platforms.
The JWR client engine's architecture is divided into two main components: a Host Bridge module and a Vue.js victim application. The Host Bridge operates within the parent phishing webpage, typically a replica of a legitimate checkout or account login page. It establishes and maintains the persistent WebSocket connection to the actor's command-and-control (C2) server and relays commands to a child iframe containing the actual phishing form.
The Vue.js application, on the other hand, is an interactive front-end that renders 44 distinct phishing pages. It collects victim input, streams keystrokes to the actor in real time, and executes over 40 different instructions issued from the C2 console. The application can operate in three communication modes: standalone, pluginIframe, and hostIframe, depending on whether it manages its own WebSocket connection or defers to an embedding frame or parent page.
During a live session, the client engine continuously streams the victim's keystrokes to the actor's C2 server while simultaneously receiving instructions from the actor. These instructions are checked against a brief history to prevent redundant execution and then routed to either redirect the victim to a different phishing page or update the current page's state. This interactive loop continues until the actor chooses to close the session, at which point all accumulated data is transmitted to the C2, and the victim is redirected to a custom error page.
The Host Bridge module assigns a unique session token to each victim, reusing existing `JWRCID` values from persistent storage if a victim has previously visited the page. This allows the actor to correlate multiple visits from the same device. New tokens are generated in the format `JWRCVV-{Date.now()}-{random1}-{random2}`, where `random1` and `random2` are 13-character base-36 strings. A Web Worker, spawned from `static/js/ws-worker.js`, isolates the WebSocket connection, ensuring its persistence even during page navigation within the phishing flow. The WebSocket connection path includes an alphanumeric suffix, such as `webSocket/QT/{sessionId}/khkjsahfjkwhakjlsdwdddddd88`, likely serving as a server-side authentication token.
The JWR client also incorporates anti-analysis checks, including a self-referential `.toString().search()` call against a backtracking regex to detect debugger attachments and decoy variables scattered throughout the code to mislead static analysis tools. It maintains a JSON array named `JwrExecutedInstructions` in `sessionStorage` to prevent the same operator instruction from executing more than once, acknowledging new instructions to the C2 server in the format `{type:"instructionAck", instruction_id:, cvv_id:}`.
Researchers observed a real-world campaign deploying the JWR client via SMS lures. These messages impersonated toll authorities, postal services, and courier companies in several countries across Southeast Asia and the Middle East, aiming to trick recipients into interacting with the malicious framework.
