Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.
- WebSocket connection streams form inputs to an operator console before victims submit
- Operators can request SMS codes, PINs, extra cards, or QR verification mid-session
- Kit rotates domains and short links; falls back to polling every two seconds
- Group-IB published IoCs including storage keys, page names, and WebSocket tokens
- Vendors
- Group-IB
- Threat actors
- OutsiderSmishing Triad
- Malware
- JWR
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trsb.top | (IoCs):- Type Indicator Description Codebase family string trsb.top String referenced inside the JWR worker and used to identif |
From the original article
5 min read at cybersecuritynews.com
A new SMS phishing campaign turns a routine payment check into a live fraud session. Victims who tap a link reach convincing pages seeking card details, passwords, and one-time passcodes, while criminals see information as it is entered. The operation uses urgent messages impersonating official services and claiming a fee must be settled, a delivery […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.