Hackers impersonate PayPal and Apple with new real-time phishing kit

Cisco researchers uncovered a phishing kit built to mimic checkout and login pages for major payment and shopping platforms like PayPal, Apple, and Shopify.

The tool, internally branded "JWR" by its developer and identified as the JWR phishing framework by Cisco Talos researchers , works differently from a typical phishing page.

Normally, a victim would have to enter their details and submit them for an attacker to see what was entered. But in this case, the attacker gets a live view of what the victim types, including card numbers, passwords, and verification codes before they are even submitted.

They can watch a card number appear digit by digit and decide what the fake page should show – from sending a fake card-decline message to requesting another card or pushing the victim to a fake app-approval screen.

The attacker keeps a live connection through an AES-CTR-encrypted WebSocket channel, with a background worker maintaining the connection with C2. This keeps the attacker connected as the victim moves between pages, with each instruction checked by the client engine to ensure that nothing already executed runs twice.

Therefore, the threat actor has extensive remote control of what the person sees and when they see it. They can dynamically update the current page's state and displayed status or request new actions.

If the actor doesn’t like the entered card, they can show a "your card was declined" message as many times as they want, harvesting more financial details from the same victim. If the actor accepts the card details, the victim is redirected to a verification page to confirm their identity with a one-time code.

A rejected code prompts the victim to re-enter it, while an accepted one redirects them to the real website.

And just like that – the attacker now possesses the information they entered.

The framework’s engine can impersonate many recognizable brands, including PayPal, Apple, Klarna, Shopify, WooCommerce, banks, and other checkout pages.

Specifically with Shopify and WooCommerce, the situation is a bit more complex. The kit has purpose-built integrations for both platforms that can reconstruct a victim’s shopping cart from their cart data with real items, making it pretty much impossible to distinguish the fake checkout page from the real one.

Talos researchers have identified 44 phishing pages and more than 40 distinct instructions issued from the command-and-control (C2) console.

According to researchers, the targeted data is not limited to payment details but includes identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints.

Talos observed the scam being used with SMS phishing related to toll or road-pricing fees and postal or courier services in Southeast Asia and the Middle East. The SMS contains a malicious URL that redirects the victim to a fake website, which loads the client-side JavaScript engine of the JWR phishing framework.

Talos notes that the operator interface contains Simplified Chinese, indicating that a Chinese-speaking actor was behind the observed campaign.

Researchers said they assess “with medium confidence” that JWR is a variant of the Outsider PhaaS platform that has been in operation since 2023, based on similarities in the client engine scripts and functionalities. The Outsider caused an estimated $1.9 billion in losses across 55 countries.

The FBI announced a takedown operation against the Outsider in June 2026 as part of Operation Ghost Hook, but Talos said the platform had previously been sold as a self-service product in the actor's Telegram channels, so variants may still be circulating online.