Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
58
Threat actor
Smishing Triad
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 17, 2026
- Last mentionedSep 16, 2026
Timeline
3 articles · newest firstSmishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials
Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.
65
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.
72
Appears with
- Outsiderthreat actor · 2
- Palo Alto Networksvendor · 2
- Group-IBvendor · 2
- Unit 42organization · 2
- Advanced URL Filteringvendor · 1
- Advanced DNS Securityvendor · 1
- JWRproduct · 1
- PayPalvendor · 1
- Dominet (HK) Limitedorganization · 1
- Palo Alto Networksorganization · 1
- Advanced URL Filteringproduct · 1
- U.S. residentsvictim · 1
- Group-IBorganization · 1
- JWRmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.