JWR Phishing Framework Uses Real

Cybersecuritynews •Tushar Subhra Dutta • August 18, 2026

JWR is a phishing framework built for live fraud. It turns a fake payment or bank page into a live channel that lets criminals watch details arrive as they are typed. The campaign uses SMS messages posing as unpaid toll notices, parcel delivery charges, or courier alerts. A link opens a convincing login page, where […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Real-Time Phishing Kit JWR Targets Payment Platforms with Live Keystroke Monitoring Cisco Talos researchers have identified a new phishing kit named JWR that allows attackers to monitor victims' keystrokes in real-time. This kit can impersonate major platforms like PayPal and Apple, enabling attackers to harvest sensitive information such as card numbers, passwords, and 2FA codes before submission. The framework operates through an AES-CTR-encrypted WebSocket connection, providing attackers with dynamic control over the victim's experience. JWR has been observed in phishing campaigns linked to SMS messages in Southeast Asia and the Middle East. The kit's capabilities include reconstructing shopping carts from real data, making it difficult for victims to distinguish between fake and legitimate pages. Researchers have identified 44 phishing pages and over 40 distinct commands issued from the command-and-control console. The scope of the attack is extensive, targeting not only payment details but also identity documents and full device fingerprints. 4 sources 67

Extracted Entities

JWR Phishing Framework Uses Real

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Tools (1)