A new phishing platform called “JWR” gives attackers real-time control over social engineering attacks, according to researchers at Cisco Talos. The kit livestreams the phishing page to the attacker as the victim is entering information, allowing the attacker to steer the victim’s experience and maximize the damage.
“JWR is a phishing framework capable of harvesting complete payment card data, login credentials, and personally identifiable information (PII) documents and images in real time,” the researchers explain. “The client-side engine of the framework impersonates login and checkout flows of several payment gateways, including Shopify, PayPal, Apple, Klarna, and banks, while allowing the operator to stealthily control the victim session through an AES-CTR encrypted WebSocket channel....The data exfiltration schema is a cvvform object that includes fields such as credit card number, CVV, PIN, expiry date, Social Security Number (SSN), passport or ID images, two-factor authentication (2FA) codes, website logins, PayPal credentials, and device fingerprint.”
Attackers are using the platform to launch widespread text message phishing campaigns impersonating government agencies, such as transport authorities and postal services.
“The victimology of this scam campaign illustrates a broad, multi-country SMS phishing (smishing) operation rather than a single targeted campaign,” Cisco Talos says. “Most of the malicious URLs impersonate a national land transport authority and its vehicle services or road toll payment portal, consistent with an ‘unpaid toll or road pricing fine’ lure in Singapore. A second set of malicious URLs impersonates a national postal service, aligned with a ‘parcel held pending a customs or delivery fee’ lure, alongside a smaller cluster mimicking an electronic toll collection system in the UAE. The third set of URLs impersonates a regional courier brand utilized across several Southeast Asian countries, again centered around the undelivered parcel or cash on delivery fee theme.”
Cisco Talos has the story: https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/
