JWR puts a live operator behind the phishing page, and your exfil detection is watching the wrong door

Cisco Talos has published an analysis of a previously undocumented phishing framework that its own developer brands "JWR", built to impersonate checkout and login pages across major payment and shopping platforms ^[1], including Shopify, PayPal, Apple, Klarna and banks ^[2]. The part that matters operationally is the plumbing: instead of logging form submissions like a static credential-stealing page, the client engine holds an AES-CTR encrypted WebSocket open to the threat actor so the operator can steer each victim session live ^[3].

That changes what a session looks like on the wire and what an operator can do with it. The victim-facing component is a Vue.js application that renders across 44 phishing pages, streams the victim's keystrokes to the actor as they are typed, and executes more than 40 distinct instructions issued from the command-and-control console ^[4]. Execution mode is picked by a single global flag, window.__HOST_MODE, set by the parent phishing page ^[6]. If it is set, a Host Bridge module runs inside the parent page, typically a replica of a legitimate checkout or account login page, and relays details into a child iframe containing the actual phishing form while maintaining a persistent WebSocket to the C2 ^[5]. If it is not set, the application runs in Content Mode with three communication options: standalone, where it owns its own WebSocket; pluginIframe, where it has no direct network link at all and passes everything up to an embedding plugin frame; and hostIframe, where it defers to a parent page already acting as the relay bridge ^[7]. That is four distinct paths off the victim's browser ^[16], with a background worker module keeping the C2 connection alive ^[14] and a redirect to a custom error page once data has been sent ^[15].

The collection schema is a cvvform object covering card number, CVV, PIN, expiry, Social Security number, passport or ID images, 2FA codes, website logins, PayPal credentials and device fingerprint ^[9]. Talos says the actor's take extends well past payment data to identity documents, passport and driver's license images and full device fingerprints, all committed to the actor's server once a session ends ^[10].

Two consequences follow. First, controls tuned to spot HTTP form posts of card or credential data to attacker-controlled domains will not see this transfer, because it leaves over a WebSocket and is encrypted by a JwrCrypto module with a freshly generated key unless a DEV_MODE flag is set, in which case it goes as plaintext JSON ^[8][17]. Second, because keystrokes stream as typed and the operator issues instructions during the session, one-time codes and ID photos are usable while the victim is still on the page rather than after the fact ^[18].

On provenance, Talos assesses with medium confidence that JWR is a variant of "The Outsider", a phishing-as-a-service platform, based on similarities in client engine scripts and functionality ^[11]; The Outsider is operated by a Chinese-speaking actor tracked as "Outsider Enterprise", per external researchers cited by Talos ^[12]. Delivery observed in the wild was SMS lures impersonating toll authorities and postal and courier services in several countries in Southeast Asia and the Middle East ^[13].