PayPal

The JWR phishing framework is a sophisticated, operator-steered PhaaS platform that uses persistent WebSocket connections to capture PII, payment credentials, and device fingerprints in real-time.

Talos has begun tracking phone numbers in emails as indicators of compromise, revealing insights into their reuse in scam campaigns where attackers use API-driven VoIP services for cost-effective operations, rotating phone number blocks to evade security filters, and maximizing reach by recycling numbers across diverse lures.