JWR live-operator WebSocket phishing session (webSocket/QT path)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects sustained WebSocket connections to known C2 infrastructure associated with the JWR phishing framework. The rule identifies long-running sessions or frequent reconnection patterns characteristic of a live human operator interacting with a victim, as opposed to automated, one-time form submissions.