JWR: A Real-Time PhaaS Using WebSockets to Monitor Victim Input and Remotely Control Screen Transitions

1. Basic Information

• Severity: High
• Article Title: Dissecting the JWR phishing framework
• Publisher: Cisco Talos Blog
• Publication Date: 2026-08-13
• Original Source: https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/
• Related Sources: Talos IOC repository (linked in the original article)
• Related Entities: JWR, The Outsider, Outsider Enterprise, Shopify, WooCommerce, PayPal, Apple, Klarna, Vue.js, WebSocket

2. Executive Summary

JWR is not a static credential-stealing page. It is a Chinese-language PhaaS (Phishing-as-a-Service) that uses AES-CTR encrypted WebSockets to stream credit card details and credentials to attackers as the victim types them. The attacker uses over 40 different commands to dynamically trigger real-time screen switches for OTPs, secondary cards, and banking app approvals.

3. Attack Flow

Real-Time Exfiltration via SMS

1. The user receives an SMS disguised as a toll fee, postal service, or delivery company, which leads them to a malicious URL.
2. The parent page sets window.__HOST_MODE and launches the Host Bridge or Vue.js Content Mode.
3. It creates a session ID in the format JWRCVV-<timestamp>-<random>-<random>, and a Web Worker maintains the WebSocket connection.
4. An initial beacon sends the IP address, country, referrer URL, and device/OS information to the C2 server.
5. Input field values are streamed to the C2 server in real-time before the user clicks submit, allowing the attacker to review them.
6. The attacker uses commands like to_info, to_card, to_sms, to_2fa, to_pin, and to_app to remotely switch the victim's screen.
7. Fake errors such as tip_fail or tip_change_card are displayed to trick the user into entering a secondary card or re-entering information.
8. Upon completion, all cvvform data is sent via POST to api/open/the_final_interface, and the user is redirected to the legitimate website.

Alternative Communication Channels

• In environments where WebSockets are blocked, the framework falls back to HTTP long polling via api/open/pollInstruction to fetch the same commands.
• It supports Host Bridge, plugin iframe, and host iframe modes, even in configurations where child iframes cannot reach the C2 server directly.

4. Attacker Positioning and Execution Location

• The JWR management console and C2 server run on the attacker's infrastructure.
• The Host Bridge, Vue.js application, and Web Worker run inside the victim's browser.
• The attacker monitors individual sessions from the management dashboard and manually dictates the next screen and error messages.

5. Visibility for Victims and Administrators

• The victim sees a Shopify or WooCommerce checkout page that accurately replicates real product names, quantities, and amounts.
• Credentials are stolen before the submit button is even pressed, and card declines or OTP failures appear legitimate.
• Security Operations Centers (SOCs) can observe SMS URLs, long-lived binary WebSockets, Web Workers, continuous REST API requests, and the final POST request.

6. Success and Failure Conditions

Success Conditions

• The user opens the SMS link and enters their information.
• WebSockets or long polling are allowed by the network.
• The victim trusts the fake brand, cart information, and screen transitions.
• The attacker successfully keeps pace with the victim's input and legitimate authentication processes in real-time.

Failure Conditions

• SMS URLs or newly registered domains are blocked.
• JWR-specific WebSocket paths, REST endpoints, and JavaScript signatures are detected.
• The user checks the checkout domain and refuses to enter a secondary card after seeing a fake error.
• Financial institutions flag the card or OTP use immediately following exfiltration as high-risk.

7. What Happens on Success

Card numbers, CVVs, PINs, up to three sets of web credentials, PayPal, Apple, Klarna accounts, SMS/email OTPs, banking app approvals, ID card images, SSNs, cookies, and device fingerprints may be stolen. The operator can view values as they are typed and select the appropriate authentication screen next.

8. Observable Logs

• Email: The primary vector is SMS. In email-based campaigns, check for spoofed URLs and branding.
• Proxy/SWG/DNS: Newly registered domains, WebSocket upgrades, webSocket/QT/..., api/open/addClick, getSyncSettings, pollInstruction, addCvv, and the_final_interface.
• Endpoint/EDR: Browsers, iframes, Web Workers, and JWRCID / JwrExecutedInstructions in sessionStorage. No endpoint malware is required.
• Identity/IdP: Logins, OTPs, push approvals, and anomalous devices or locations immediately following exfiltration.
• SaaS/Cloud: Shopify/WooCommerce order/cart referrers and payment provider fraud logs.
• Network: Long-lived WebSockets, AES-CTR encrypted binary traffic, and fallback to long polling when WebSockets are blocked.

9. Attack Progression Stages

• Contact Only: SMS received, URL accessed.
• Initial Session: addClick event, JWRCID generated, WebSocket established.
• User Interaction: Personal information, credit card, and OTP input events.
• Data Exfiltration: Successful addCvv or the_final_interface request, followed by fraudulent use of the data.
• Authentication Success: Attacker session or card approval confirmed in separate logs.
• Subsequent Compromise: Account takeover or successful fraudulent payment confirmed.

10. Investigation Playbook

• Trigger: JWR URL, WebSocket path, REST endpoint, ClamAV/Snort detection, or unauthorized login immediately following an OTP prompt.
• Initial Verification: Preserve SMS messages, URLs, timestamps, input fields, browser history, and DNS/proxy logs.
• Endpoint: Preserve browser storage, Service Workers/Web Workers, DevTools logs, and cookies.
• Authentication/Cloud: Revoke and review target service sessions, OTPs, push notifications, and card authorizations.
• Subsequent Actions: Check for secondary card usage, access to email/PayPal/Apple accounts, or identity document misuse.
• Containment: Revoke sessions, change credentials, block cards, block domains, and report the SMS vector.
• Classification: Delivered / Session Established / Data Entered / Exfiltrated / Account or Payment Compromised.

11. Defense and Detection Ideas

• Single Event: JWR endpoints, JWRCVV- strings, unique WebSocket suffixes, and Talos Snort SIDs 66924–66928.
• Time-Series Correlation: SMS click -> arrival beacon -> WebSocket -> multiple authentication screens -> final POST -> redirect to legitimate site.
• Hunting: api/open/*, Vue 2 phishing bundles, 44 page command names, and abuse of Shopify cart_data.
• Log Gaps: Without cross-referencing SMS, browser WebSockets, POST bodies, and card authorization logs, determining success is difficult.
• Priority Actions: URL inspection, WebSocket monitoring, step-up authentication for financial transactions, user awareness training, and detecting communication patterns rather than relying solely on IOCs.

12. Facts / Inference / Hypothesis

Facts

• Talos confirmed JWR in active SMS campaigns.
• The framework features 44 phishing pages and over 40 operator commands.
• It streams input values to the C2 server sequentially as the user types.
• Talos assesses with medium confidence that this is a variant of The Outsider.
• Management messages are written in Simplified Chinese.

Inference

• This attack can easily be adapted for regional delivery, toll, and e-commerce brands by simply swapping out templates.
• Blocking WebSockets alone is insufficient because the framework falls back to long polling; correlation between endpoints and behavioral patterns is required.

Hypothesis

• Rapid screen transitions demanding multiple cards or OTPs after displaying a failure message can serve as a more effective user-side signal than static URL evaluation.

13. MITRE ATT&CK Mapping

• High Confidence: T1566.002 Spearphishing Link, T1056 Input Capture, T1539 Steal Web Session Cookie, T1111 Multi-Factor Authentication Interception, T1185 Browser Session Cookie, T1071.001 Web Protocols.
• Medium Confidence: T1656 Impersonation, T1583.001 Domains, T1041 Exfiltration Over C2 Channel.

14. Unknowns / Areas for Further Investigation

• The relationship between JWR operators and Outsider Enterprise.
• C2 infrastructure, sales channels, total number of victims, and actual financial losses.
• The existence of localized language templates.

15. Impact on SOCs and Organizations

SMS messages disguised as delivery services, e-commerce platforms, or toll fees can easily trick users. In addition to securing mobile URLs, organizations must correlate WebSocket traffic, REST fallbacks, and anomalous logins following OTP prompts with financial and identity logs.

16. Summary by Target Audience

• For SOCs: Correlate not only WebSockets, but also REST fallbacks and final POST requests.
• For Administrators: Implement JWR signatures, Snort SIDs, SMS URL inspection, and authentication risk scoring.
• For End Users: Never enter credit card details or OTPs in response to SMS messages about unpaid fees or redelivery links. Stop immediately if a fake error asks for a secondary card.