JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real

Gbhackers •Mayura Kathir • August 18, 2026

JWR, an undocumented phishing-as-a-service (PhaaS) framework that turns conventional credential theft into an operator-led, real-time banking and payment fraud operation. Rather than waiting for a victim to submit a form, JWR streams keystrokes to an attacker over an AES-CTR-encrypted WebSocket channel, allowing the operator to react while card numbers, passwords and one-time codes are still […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Real-Time Phishing Kit JWR Targets Payment Platforms with Live Keystroke Monitoring Cisco Talos researchers have identified a new phishing kit named JWR that allows attackers to monitor victims' keystrokes in real-time. This kit can impersonate major platforms like PayPal and Apple, enabling attackers to harvest sensitive information such as card numbers, passwords, and 2FA codes before submission. The framework operates through an AES-CTR-encrypted WebSocket connection, providing attackers with dynamic control over the victim's experience. JWR has been observed in phishing campaigns linked to SMS messages in Southeast Asia and the Middle East. The kit's capabilities include reconstructing shopping carts from real data, making it difficult for victims to distinguish between fake and legitimate pages. Researchers have identified 44 phishing pages and over 40 distinct commands issued from the command-and-control console. The scope of the attack is extensive, targeting not only payment details but also identity documents and full device fingerprints. 4 sources 67

Extracted Entities

JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Tools (1)