Loading story…
A Smishing Triad operator cluster tracked as Outsider is deploying the reusable JWR phishing kit in SMS campaigns impersonating toll, delivery, payment, and account-verification services. Shortened links send targets to short-lived, brand-skinned phishing pages where a persistent WebSocket connection streams every form-field update—including payment-card details, credentials, PINs, and one-time passcodes—to operators before the victim submits the form. Operators can steer victims through up to 32 pages or in-page transitions; JWR falls back to HTTP long polling at two-second intervals when WebSockets are unavailable.
The same tooling has been linked to fraudulent Shopify storefronts promoted through malicious Google Shopping ads. A checkout redirect script routes shoppers to attacker-controlled payment pages, while Shopify Admin API order confirmations help make the transactions appear legitimate; a related Playswing kit provides separate MQTT-backed phishing infrastructure. Researchers reported more than 2,000 active fake stores, with roughly 100 added weekly. Although domains and brand templates rotate rapidly, defenders can hunt for JWR storage keys, JavaScript and page names, API and WebSocket paths, tokens, session naming, traffic patterns, and related WordPress or Shopify integration markers; extracted indicators should be validated before blocking.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
BforeAI disclosed the fraudulent Shopify-store campaign to Shopify and reported that it had received no response by September 14, 2026.
Group-IB identified the reusable JWR phishing kit in SMS-phishing activity and linked it to the Outsider operator cluster within the broader Smishing Triad ecosystem. The kit streams form-field changes, including payment-card data and OTPs, to operators through WebSockets before victims submit forms.
BforeAI published a technical report describing a campaign that used brand-impersonating Shopify stores and fraudulent Google Shopping ads to direct buyers to attacker-controlled payment pages. The report linked the operation to Outsider/JWR and Playswing phishing kits and estimated more than 2,000 active stores, with roughly 100 added weekly.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed an undocumented phishing framework named **JWR** that supports real-time, operator-driven phishing sessions instead of simple static credential harvesting. The kit impersonates checkout and login flows for brands including **Shopify, PayPal, Apple, Klarna**, banks, and e-commerce storefronts, while sending victim keystrokes, device details, and browser fingerprints to command-and-control infrastructure over encrypted WebSocket connections with HTTP fallback. Talos said JWR can collect payment card data, account credentials, Social Security numbers, identity documents, passport and driver’s license images, and **2FA** codes, and it includes more than 40 operator commands across 44 phishing pages. Researchers assessed with medium confidence that JWR is a variant of **The Outsider** phishing-as-a-service platform because of substantial code and functional overlap. Talos also linked the framework to active **smishing** campaigns using toll-road, postal-service, and courier payment lures across Southeast Asia and the Middle East, and said Chinese-language operator messages indicate the activity is likely tied to Chinese-speaking threat actors within the broader phishing-as-a-service ecosystem.
Aug 28, 2026
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with **live operator consoles** to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, `jtexpress.mwkqbr[.]club`, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the `/com/socket.io/` path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later. The findings mirror a broader investigation into **Darcula** and its `Magic Cat` phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Aug 24, 2026
The ChenLun-operated **Outsider Phishing Kit** phishing-as-a-service operation remained active after Operation Ghost Hook disrupted its infrastructure, domains, cryptocurrency wallets, and Shopify storefront. Group-IB identified more than 700 newly created phishing pages in the month after the action, indicating that affiliates retained access to the kit or its underlying capabilities despite the seizure of core assets. Google had filed a civil lawsuit against the operation before the FBI, Google, and Lumen Black Lotus Labs announced the disruption. From December 2025 through May 2026, Outsider generated more than 100,000 phishing pages across at least 54 countries using 267 templates impersonating financial institutions, telecom providers, postal and shipping services, government agencies, toll operators, brokerages, and e-commerce brands. The platform primarily distributes SMS phishing and provides adversary-in-the-middle interception, live WebSocket-based operator interaction, configurable MFA prompts, session tracking, crawler detection, and real-time theft of credentials, payment-card data, and authentication codes.
Sep 3, 2026