JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking Fraud

JWR, an undocumented phishing-as-a-service (PhaaS) framework that turns conventional credential theft into an operator-led, real-time banking and payment fraud operation.

Rather than waiting for a victim to submit a form, JWR streams keystrokes to an attacker over an AES-CTR-encrypted WebSocket channel, allowing the operator to react while card numbers, passwords and one-time codes are still being entered.

Its collection scope reaches beyond payment cards: the kit can harvest account credentials, PINs, SMS OTPs, 2FA codes, identity documents, passport and driver’s-license images, addresses, device fingerprints and geolocation-related data.

The technical differentiator is persistence. JWR’s host bridge initializes a unique victim session identifier and creates a dedicated Web Worker from static/js/ws-worker.js.

That worker keeps the WebSocket connected to command-and-control infrastructure even as the victim is moved between phishing pages.

This allows the actor to preserve visibility and control throughout a multi-step checkout or bank-verification flow rather than losing the session during redirects.

Talos observed the framework using a binary WebSocket path structured as webSocket/QT/{sessionId}/khkjsahfjkwhakjlsdwdddddd88.

Data can be wrapped by the kit’s JwrCrypto module using a newly generated encryption key before transmission.

AES-CTR does not make the campaign benign or inherently anonymous, but it complicates simple network inspection that relies on readable form-field values or predictable HTTP POST bodies.

The victim-facing component is a Vue 2.x application spanning 44 phishing pages. It includes an instruction-dispatch mechanism that maps more than 40 C2 commands to specific stages of the fraud workflow.

An operator can direct a victim to card-entry, account-password, bank-login, app-approval, QR-code, email-OTP, SMS-OTP, PIN or custom verification pages in real time.

That capability materially changes the fraud model. If an operator dislikes a card entered by a victim, JWR can display a fraudulent decline message through commands such as tip_fail or tip_change_card, prompting the target to submit another payment card.

Andrea Fortuna Researchers said that, JWR impersonates checkout and login workflows associated with Shopify, PayPal, Apple, Klarna, banks and other payment-oriented brands.

If the card appears valuable, the actor can immediately transition the victim toward a bank OTP, app approval or 2FA prompt.

The victim sees a familiar transaction failure or verification sequence; the operator receives a live decision point.

JWR Phishing-as-a-Service

JWR also supports a fallback mechanism for environments where persistent WebSockets fail.

The kit registers REST endpoints including api/open/addClick for victim-arrival telemetry, api/open/getSyncSettings for attacker-controlled configuration, api/open/pollInstruction for HTTP long-polling, and api/open/the_final_interface for final session exfiltration.

This design gives operators a resilient channel for remotely steering victims even when network controls interrupt the preferred socket connection.

Cisco Talos assessed with medium confidence that JWR is a variant of The Outsider PhaaS platform access, citing similarities in client-side code and functionality.

The analysis noted that JWR does not share code-level implementation with Lucid, Darcula or Lighthouse, though it follows the same broader ecosystem pattern of live operator control, multi-brand templates and OTP interception.

Observed delivery activity relied on smishing lures themed around unpaid tolls, road-pricing fines, parcel-delivery fees and courier notifications across Southeast Asia and the Middle East.

High-value detection points include newly registered or low-reputation domains hosting WebSocket paths matching the JWR pattern, suspicious long-lived browser WebSocket connections following SMS-linked visits, and requests to the kit’s distinctive REST endpoints.

These lures route targets to a fake site that loads JWR’s embedded JavaScript engine and begins session fingerprinting before the victim provides sensitive data.

Security teams should also hunt for the ClamAV signature Js.Phishing.JwrFramework-10060456-0 and Cisco Snort SIDs 66924 through 66928, while treating payment-verification pages that solicit multiple cards or repeated OTPs as likely real-time fraud attempts.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now