MalwareUsed by 1 actor

JWR

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

The Outsider

JWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Next, it initializes the communication channel, captures the victim's action, and creates a CVV form with the victim's device fingerprint data. This includes the victim's current form of state, such as device type, browser, language, time zone, and geolocation, which are encrypted and sent to the actor's C2 server.

Initial Access

2 techniques

T1566PhishingEvidence3

A link opens a convincing login page, where the framework collects card details, account credentials, identity documents, and verification codes.

T1566.003Spearphishing via ServiceEvidence2

Talos observed a real-world campaign delivering the JWR client via SMS lures impersonating toll authorities, and postal and courier services of several countries in Southeast Asia and the Middle East.

Execution

1 technique

T1059.007JavaScriptEvidence1

When victims click on the URL, it opens a fake webpage that executes embedded JavaScript, which then renders and loads the client-side JavaScript engine of the JWR phishing framework.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Regardless of which of these three modes or through the Host Bridge is used, the data is either sent to C2 as plain text in JSON format with the DEV_MODE flag set, or it is passed to the JwrCrypto module, which encrypts it with a newly generated key before sending it to the C2 server.

T1036MasqueradingEvidence1

The framework includes templates that imitate payment, shopping, and bank services, and can rebuild product details from a shopping cart.

T1497.001System ChecksEvidence1

The host bridge incorporates an anti-analysis check, which serves as a one-time execution guard that performs a self-referential .toString().search() call against a backtracking regex. This check detects whether a debugger has attached the function to modify its apparent source.

T1622Debugger EvasionEvidence1

Credential Access

2 techniques

T1056Input CaptureEvidence3

Data can reach an operator before a victim presses submit... JWR captures partial passwords, card numbers, and one-time codes as they are entered.

T1539Steal Web Session CookieEvidence1

The JWR client has a data exfiltration schema... including an automatically captured browser fingerprint, including IP, device, language, time zone, user agent, cookies, and geolocation.

Discovery

4 techniques

T1082System Information DiscoveryEvidence1

T1497.001System ChecksEvidence1

T1614System Location DiscoveryEvidence1

Once the DOM is ready... it executes two functions: getIPInfo() to geolocate the victim’s IP address

T1622Debugger EvasionEvidence1

Collection

1 technique

T1056Input CaptureEvidence3

Data can reach an operator before a victim presses submit... JWR captures partial passwords, card numbers, and one-time codes as they are entered.

Command and Control

4 techniques

T1008Fallback ChannelsEvidence1

For the victim’s environments where a persistent WebSocket connection is unavailable or blocked, api/open/pollInstruction provides an HTTP long poll fallback that delivers the same operator instruction objects the socket would otherwise push.

T1071Application Layer ProtocolEvidence1

JWR uses a persistent WebSocket connection for continuous exchanges with a server. Its client encrypts traffic with AES-CTR, helping obscure the exchange while an operator controls each stage of a fraudulent session in real time.

T1071.001Web ProtocolsEvidence2

Talos discovered that the primary mode of C2 communication for the JWR kit is via a binary WebSocket connection... Alongside the WebSocket, the JWR client registers five REST endpoints which are used as an alternate communication method, between the C2 and the victim browser.

T1573Encrypted ChannelEvidence2

Its client encrypts traffic with AES-CTR, helping obscure the exchange while an operator controls each stage of a fraudulent session in real time.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

At the end of a session, it sends the data to attackers and can redirect the victim to the genuine site... API endpoint api/open/addCvv Data-exfiltration endpoint

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Aug 18, 2026

JWR Phishing Framework Uses Real-Time WebSocket Control and AES Encryption to Steal Banking Credentials

A real-time phishing framework that uses persistent WebSocket communications and AES-CTR-encrypted client traffic to let operators guide victims through fraudulent payment or banking flows while harvesting credentials, card data, PINs, one-time codes, identity documents, cookies, and device information. It supports multi-step operator control, fallback polling, exfiltration endpoints, and redirection to legitimate sites after data theft.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

JWR

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

The Outsider

JWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Initial Access

2 techniques

T1566PhishingEvidence3

A link opens a convincing login page, where the framework collects card details, account credentials, identity documents, and verification codes.

T1566.003Spearphishing via ServiceEvidence2

Execution

1 technique

T1059.007JavaScriptEvidence1

When victims click on the URL, it opens a fake webpage that executes embedded JavaScript, which then renders and loads the client-side JavaScript engine of the JWR phishing framework.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

The framework includes templates that imitate payment, shopping, and bank services, and can rebuild product details from a shopping cart.

T1497.001System ChecksEvidence1

T1622Debugger EvasionEvidence1

Credential Access

2 techniques

T1056Input CaptureEvidence3

Data can reach an operator before a victim presses submit... JWR captures partial passwords, card numbers, and one-time codes as they are entered.

T1539Steal Web Session CookieEvidence1

The JWR client has a data exfiltration schema... including an automatically captured browser fingerprint, including IP, device, language, time zone, user agent, cookies, and geolocation.

Discovery

4 techniques

T1082System Information DiscoveryEvidence1

T1497.001System ChecksEvidence1

T1614System Location DiscoveryEvidence1

Once the DOM is ready... it executes two functions: getIPInfo() to geolocate the victim’s IP address

T1622Debugger EvasionEvidence1

Collection

1 technique

T1056Input CaptureEvidence3

Data can reach an operator before a victim presses submit... JWR captures partial passwords, card numbers, and one-time codes as they are entered.

Command and Control

4 techniques

T1008Fallback ChannelsEvidence1

T1071Application Layer ProtocolEvidence1

T1071.001Web ProtocolsEvidence2

T1573Encrypted ChannelEvidence2

Its client encrypts traffic with AES-CTR, helping obscure the exchange while an operator controls each stage of a fraudulent session in real time.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

At the end of a session, it sends the data to attackers and can redirect the victim to the genuine site... API endpoint api/open/addCvv Data-exfiltration endpoint

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Aug 18, 2026

JWR Phishing Framework Uses Real-Time WebSocket Control and AES Encryption to Steal Banking Credentials

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.