JWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed.

The campaign uses SMS messages posing as unpaid toll notices, parcel delivery charges, or courier alerts.

A link opens a convincing login page, where the framework collects card details, account credentials, identity documents, and verification codes.

Cisco Talos identified JWR, while security researcher Andrea Fortuna has separately highlighted how phishing can turn a small initial mistake into a much larger compromise. Data can reach an operator before a victim presses submit.

Cisco Talos said in a report shared with Cyber Security News (CSN) that the framework likely has ties to the Chinese-speaking phishing-as-a-service ecosystem known as The Outsider.

Talos assesses that link with medium confidence, based on similarities in client-side scripts and functions.

JWR Phishing Framework Uses Real-Time WebSocket Control

JWR uses a persistent WebSocket connection for continuous exchanges with a server.

Its client encrypts traffic with AES-CTR, helping obscure the exchange while an operator controls each stage of a fraudulent session in real time.

The tool assigns a unique session ID and runs a background worker that keeps the connection alive as the victim moves between pages.

This makes the scam feel less like a generic form and more like a guided checkout, echoing a real-time phishing service report.

Work flow (Source - Cisco Talos) — Work flow (Source – Cisco Talos)

More than 40 operator commands can move a visitor from a login screen to personal information, card data, SMS code, PIN, or banking-app approval prompts.

The operator can also display a fake decline message and ask for another card, extracting additional information without revealing the fraud.

JWR captures partial passwords, card numbers, and one-time codes as they are entered.

At the end of a session, it sends the data to attackers and can redirect the victim to the genuine site, a detail that may delay suspicion and help criminals act quickly in near real time.

The framework includes templates that imitate payment, shopping, and bank services, and can rebuild product details from a shopping cart.

That realism matters because victims may see familiar items, totals, and branding rather than an obvious fake. Similar multi-step fraud was documented in a bank theft campaign analysis.

Smishing Lures Raise Banking Risk

Talos observed JWR delivered through text messages impersonating toll authorities and postal or courier services in Southeast Asia and the Middle East.

The lures create urgency around a small unpaid fee or delayed parcel, betting that a rushed recipient will tap first and verify later. The campaign is especially dangerous because it does not stop at a password.

It seeks complete payment-card information, PINs, login details, one-time passwords, identity records, document images, cookies, and device information. That collection can support account takeover, payment fraud, and further identity abuse.

For organizations, blocking known phishing sites is necessary but not enough. Security teams should watch for unusual browser connections, rapid movement through authentication pages, or requests to unfamiliar domains.

They should prepare for alternate web requests when a persistent connection is blocked, as criminal kits increasingly adapt.

People should not use links in unexpected messages to settle tolls, delivery fees, or account problems. Instead, they should open the official app or type the known website address themselves.

Deobfuscated view of JWR client’s program with hardcoded status messages in Simplified Chinese (Source - Cisco Talos) — Deobfuscated view of JWR client’s program with hardcoded status messages in Simplified Chinese (Source – Cisco Talos)

Anyone who has entered data should contact the bank, change reused passwords, and review recent transactions.

Banks can reduce harm by using transaction alerts, risk checks for unusual sign-ins, and clear warnings about active scams.

Wider awareness is important because fake toll message scams use the same pressure tactics, while GitHub Pages banking lures show how quickly criminals can rotate convincing infrastructure. JWR shows that phishing pages are becoming live fraud consoles.

A victim who sees a familiar logo, a realistic basket, and a request for a code may believe a payment is being verified, when an operator is actually steering every screen and harvesting account data.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File path	`static/js/ws-worker.js`	Web Worker used to maintain the phishing framework’s WebSocket connection
Session identifier pattern	`JWRCVV-{Date.now()}-{random1}-{random2}`	Format used to create a victim session identifier
WebSocket path	`webSocket/QT/{sessionId}/khkjsahfjkwhakjlsdwdddddd88`	Observed WebSocket connection path used by the JWR client
API endpoint	`api/open/addClick`	Victim-arrival beacon that transmits fingerprinting data
API endpoint	`api/open/getSyncSettings`	Endpoint used to retrieve attacker-controlled configuration settings
API endpoint	`api/open/pollInstruction`	HTTP long-polling fallback for operator instructions
API endpoint	`api/open/addCvv`	Data-exfiltration endpoint
API endpoint	`api/open/the_final_interface`	Terminal POST endpoint used to transmit the complete collected form data
Detection signature	`Js.Phishing.JwrFramework-10060456-0`	ClamAV detection signature listed for JWR
Snort rule IDs	`66924`, `66925`, `66926`, `66927`, `66928`	Snort 2 and Snort 3 rules listed for detection and blocking

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post JWR Phishing Framework Uses Real-Time WebSocket Control and AES Encryption to Steal Banking Credentials appeared first on Cyber Security News.