Smishing Triad's JWR Kit Targets Victims via SMS Phishing

• •The JWR phishing kit is used in a large-scale smishing campaign targeting sensitive information.
• •Victims are lured through SMS messages impersonating trusted entities, leading to phishing domains.
• •The Smishing Triad operates as a marketplace, with various actors involved in the phishing ecosystem.

A large-scale smishing campaign has been linked to the Smishing Triad, utilizing the JWR phishing kit to steal sensitive information including payment card data, OTPs, and online banking credentials. Victims receive fraudulent SMS messages impersonating trusted entities, prompting them to click on links that lead to disposable phishing domains. The JWR kit operates as a real-time fraud platform, allowing operators to dynamically adjust the phishing flow based on victim responses. Group-IB has attributed this activity to an operator sub-cluster known as Outsider, which participates in a broader phishing-as-a-service ecosystem. The campaign has affected numerous individuals across multiple countries, with the potential for significant financial losses. The JWR kit is noted for its sophisticated architecture, employing Vue 2 single-page applications and encrypted WebSocket communications for data exfiltration. This ongoing threat highlights the need for enhanced public awareness and defensive measures against smishing attacks.