Executive Summary
Cisco Talos has identified a sophisticated, real-time phishing framework internally named "JWR," which is highly likely a variant of the "The Outsider" Phishing-as-a-Service (PhaaS) platform. Operated by Chinese-speaking actors, JWR enables live operator-driven sessions where attackers can monitor keystrokes and issue over 40 distinct instructions to victims in real-time. This allows for the immediate interception of payment data, 2FA codes, and sensitive identity documents.
The framework utilizes a complex client-side engine built on Vue.js that establishes an AES-CTR encrypted WebSocket connection to a command-and-control (C2) server. Attackers have been observed targeting Southeast Asia and the Middle East, specifically impersonating national transport authorities and postal services via SMS phishing (smishing) campaigns.
This threat is significant due to its ability to bypass traditional static detection by using dynamic frames, interactive sessions, and legitimate e-commerce integrations with platforms like Shopify and WooCommerce. Organizations in the financial and transportation sectors should be particularly vigilant regarding lures related to unpaid road tolls or parcel delivery fees.