Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials
Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.
Group-IB attributes a large-scale SMS phishing campaign to Outsider, an operator sub-cluster within the Smishing Triad phishing-as-a-service ecosystem, using a kit dubbed JWR. The Vue 2-based platform maintains real-time WebSocket communication with operators, enabling them to adapt pages live and harvest roughly 70 PII fields, card data, PINs, OTPs, identity document images, and digital wallet credentials via a dedicated PayPal sub-funnel. Unit 42 previously tied 194,345 malicious domains across 136,933 root domains to the broader operation since January 2024. Defenders can hunt for /api/open/ endpoints, /webSocket/QT/ paths, JWR-prefixed storage artifacts, and a hard-coded WebSocket token.
- Outsider operates as a customer within the Smishing Triad phishing-as-a-service ecosystem
- JWR uses Vue 2 SPA and Web Worker with WebSocket channels for real-time operator interaction
- Kit collects ~70 PII fields, identity document images, three credential slots, and a PayPal sub-funnel
- Detection markers include /api/open/ endpoints, /webSocket/QT/ path, and hard-coded WebSocket token
- Unit 42 linked 194,345 malicious domains across 136,933 root domains since January 2024
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1621 Multifactor Authentication Request Generation
- Products
- JWR
- Threat actors
- Smishing TriadOutsider
From the original article
3 min read at gbhackers.com
A large-scale SMS phishing campaign linked to the Smishing Triad is using a sophisticated phishing kit dubbed JWR to harvest payment-card data, one-time passwords, online-banking credentials, identity information, and digital-wallet logins. Group-IB attributed the activity to an operator sub-cluster tracked as Outsider, which appears to operate as a customer within the wider phishing-as-a-service ecosystem rather […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.