PayPal Login - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/paypal-login/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 13 Aug 2026 10:37:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJWR Phishing Framework Analysishttps://feed.craftedsignal.io/briefs/2026-08-jwr-phishing/Thu, 13 Aug 2026 10:37:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-jwr-phishing/The JWR phishing framework is a sophisticated, operator-steered PhaaS platform that uses persistent WebSocket connections to capture PII, payment credentials, and device fingerprints in real-time.Cisco Talos has identified an undocumented phishing framework, referred to as "JWR," which facilitates highly interactive, operator-steered credential and data theft. Unlike static phishing kits, JWR utilizes a dual-mode client engine - Host Bridge and Content Mode - to maintain a persistent, AES-CTR encrypted WebSocket connection to a C2 server. This allows attackers to monitor victims in real-time, stream keystrokes, and issue over 40 distinct instructions to steer the victim through 44 different phishing page flows. The framework captures comprehensive data, including full payment card details, Social Security numbers, passport/ID images, 2FA codes, and device fingerprints. Evidence suggests JWR may be a variant of "The Outsider" phishing-as-a-service platform. Campaigns have been observed using SMS-based lures impersonating postal and toll authorities in Southeast Asia and the Middle East, targeting users of major platforms like Shopify, PayPal, Apple, and Klarna.

Attack Chain

  1. Attacker sends SMS lures impersonating legitimate postal, courier, or toll authorities to victims.
  2. Victim clicks the link, loading a phishing page that initiates the JWR client-side engine.
  3. The client engine checks the global flag 'window.__HOST_MODE' to determine the execution path (Host Bridge or Content Mode).
  4. The Host Bridge IIFE establishes a persistent WebSocket connection to the attacker's C2 server at the path 'webSocket/QT/{sessionId}/'.
  5. The client spawns a Web Worker ('static/js/ws-worker.js') to maintain the C2 connection independently of page navigation.
  6. The attacker uses the C2 console to issue real-time instructions, such as redirecting the victim or updating the phishing page state.
  7. The client engine streams the victim's keystrokes and input data (PII, credentials, payment data) back to the C2 server in JSON format.
  8. Upon session closure, the final data payload is encrypted via the 'JwrCrypto' module and transmitted to the attacker's server.

Impact

The JWR framework facilitates high-fidelity identity and financial theft. By leveraging real-time operator control, the attackers can bypass standard MFA by prompting for codes during the interactive session. The impact includes financial fraud, full identity theft via PII/ID documentation exfiltration, and potential secondary account takeovers using harvested session credentials. While specific victim counts are not provided, the scope spans multiple international regions and major global financial/shopping brands.

Recommendation

  • Block known malicious SMS delivery infrastructure and egress traffic to identified phishing kit C2 domains.
  • Implement SMS filtering solutions that identify and flag phishing-related URLs commonly used in courier or toll authority impersonation scams.
  • Deploy web proxy or DNS-level filtering to alert on requests for 'static/js/ws-worker.js' in contexts associated with suspicious domains.
  • Educate users on the risks of interacting with unsolicited SMS messages, particularly those requesting credentials or payment to resolve postal or toll issues.
]]>highadvisoryphishingcredential-theftwebsocketsaas