JWR: A Real-Time PhaaS Using WebSockets to Monitor Victim Input and Remotely Control Screen Transitions

JWR: A Real-Time PhaaS Using WebSockets to Monitor Victim Input and Remotely Control Screen Transitions 1. Basic Information Severity: High Article Title: Dissecting the JWR phishing framework Publisher: Cisco Talos Blog Publication Date: 2026-08-13 Original Source: https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/ Related Sources: Talos IOC repository (linked in the original article) Related Entities: JWR, The Outsider, Outsider Enterprise, Shopify, WooCommerce, PayPal, Apple, Klarna, Vue.js, WebSocket 2. Executive Summary JWR is not a static credential-stealing page. It is a Chinese-language PhaaS (Phishing-as-a-Service) that uses AES-CTR encrypted WebSockets to stream credit card details and credentials to attackers as the victim types them. The attacker uses over 40 different commands to dynamically trigger real-time screen switches for OTPs, secondary cards, and banking app approvals. 3. Attack Flow Real-Time Exfiltration via SMS The user receives an SMS disguised as a toll fee, postal service, or delivery company, which leads them to a malicious URL. The parent page sets window.__HOST_MODE and launches the Host Bridge or Vue.js Content Mode. It creates a session ID in the format JWRCVV-<timestamp>-<random>-<random> , and a Web Worker maintains the WebSocket connection. An initial beacon sends the IP address, country, referrer URL, and device/OS information to the C2 server. Input field values are streamed to the C2 server in real-time before the user clicks submit, allowing the attacker to review them. The attacker uses commands like to_info , to_card , to_sms , to_2fa , to_pin , and to_app to remotely switch the victim's screen. Fake errors such as tip_fail or tip_change_card are displayed to trick the user into entering a secondary card or re-entering information. Upon completion, all cvvform data is sent via POST to api/open/the_final_interface , and the user is redirected to the legitimate website. Alternative Communication Channels