Loading story…
Cisco Talos disclosed an undocumented phishing framework named JWR that supports real-time, operator-driven phishing sessions instead of simple static credential harvesting. The kit impersonates checkout and login flows for brands including Shopify, PayPal, Apple, Klarna, banks, and e-commerce storefronts, while sending victim keystrokes, device details, and browser fingerprints to command-and-control infrastructure over encrypted WebSocket connections with HTTP fallback. Talos said JWR can collect payment card data, account credentials, Social Security numbers, identity documents, passport and driver’s license images, and 2FA codes, and it includes more than 40 operator commands across 44 phishing pages.
Researchers assessed with medium confidence that JWR is a variant of The Outsider phishing-as-a-service platform because of substantial code and functional overlap. Talos also linked the framework to active smishing campaigns using toll-road, postal-service, and courier payment lures across Southeast Asia and the Middle East, and said Chinese-language operator messages indicate the activity is likely tied to Chinese-speaking threat actors within the broader phishing-as-a-service ecosystem.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos published detection coverage for JWR, including the ClamAV signature Js.Phishing.JwrFramework-10060456-0 and Snort rules 66924 through 66928.
Cisco Talos assessed with medium confidence that JWR is a variant of The Outsider phishing-as-a-service platform. The assessment was based on substantial code and functional similarities between the two client engines.
Talos observed a real-world JWR campaign delivered through SMS phishing lures impersonating toll authorities, postal services, and courier brands. The campaign targeted victims across Southeast Asia and the Middle East.
Cisco Talos identified an undocumented phishing framework internally branded as JWR by its developer. The framework supports real-time, operator-driven phishing sessions and extensive data theft from victims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceblog.talosintelligence.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with **live operator consoles** to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, `jtexpress.mwkqbr[.]club`, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the `/com/socket.io/` path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later. The findings mirror a broader investigation into **Darcula** and its `Magic Cat` phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Aug 24, 2026
Researchers reported sustained **JsOutProx** malware operations targeting financial institutions, government bodies, and related customers across India, wider Asia, and the MENA region. The activity relied on spearphishing emails impersonating trusted organizations such as **SWIFT**, **MoneyGram**, central banks, and Indian financial agencies, with lures tied to compliance, anti-money laundering, COVID-19 notices, and sector-specific programs such as the **Kisan Credit Card** scheme. Victims were sent ZIP archives posing as PDFs, images, or office files that contained malicious **HTA**, JavaScript, or Java payloads, including incidents affecting Indian banks and a later campaign impacting customers of a major Saudi bank. The malware family used heavily obfuscated, multi-stage loaders executed through `mshta` or script hosts, then established persistence and contacted **Dynamic DNS** command-and-control infrastructure. Multiple reports describe a modular toolset capable of command execution, file theft and management, screenshot capture, clipboard and Outlook data theft, proxy and DNS manipulation, privilege escalation, and in newer variants, in-memory execution of .NET assemblies; some samples also used cookie-based HTTP communications carrying encoded victim profiling data. Researchers linked the activity to long-running campaigns against Indian co-operative banks and finance companies, observed infrastructure shifts from **GitHub** to **GitLab** for payload hosting, and noted overlaps with other malware operations while attribution remained cautious.
Aug 15, 2026
Researchers disclosed **Starkiller**, a phishing-as-a-service suite advertised by a group calling itself **Jinkusu** that uses an **adversary-in-the-middle (AiTM) reverse proxy** to bypass multi-factor authentication by relaying victims to *live* legitimate login pages while capturing credentials and session tokens for account takeover. The tooling reportedly runs a headless Chrome instance inside a **Docker** container to load the real target site and proxy traffic end-to-end, reducing the need for static phishing templates and making fingerprinting/blocklisting harder; it also provides an operator dashboard to select brands/URLs to impersonate, supports lure keyword customization (e.g., “login,” “verify,” “security,” “account”), and integrates URL shorteners (e.g., *TinyURL*) to mask destinations. Separate reporting described a targeted AiTM intrusion attempt that used multiple redirect hops and an **ASP.NET Core** reverse proxy in front of Microsoft 365 login pages, but the author could not attribute it to any known commercial kit based on published AiTM “cheat sheets,” highlighting ongoing evolution and diversification of reverse-proxy phishing stacks beyond commonly documented PHP/Node/Go/Python implementations. Other items in the set cover unrelated malware and threat activity (Android trojans, an Iraq-focused APT campaign, an APT42 PowerShell backdoor, malvertising redirect mechanics, and scam-infrastructure/supply-chain activity) and do not materially add to the Starkiller AiTM disclosure.
Jun 29, 2026