Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

A new SMS phishing campaign turns a routine payment check into a live fraud session. Victims who tap a link reach convincing pages seeking card details, passwords, and one-time passcodes, while criminals see information as it is entered.

The operation uses urgent messages impersonating official services and claiming a fee must be settled, a delivery confirmed, or an account verified. Shortened links redirect recipients to temporary phishing sites, where the scam can move from personal details to bank information and OTPs.

Group-IB analysts identified the JWR phishing kit and linked the activity to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem.

Group-IB said in a report shared with Cyber Security News (CSN) that the campaign combines disposable infrastructure with a live operator console, letting fraudsters adapt the page while a victim remains online.

The impact goes beyond a conventional password-stealing page. The kit can collect identity information, payment-card data, bank credentials, and verification codes, providing material for account takeover and unauthorized payments. Its rotating domains also make simple blocklists less reliable.

Smishing Hackers Can Watch Every Keystroke

The JWR kit turns a fake payment page into a two-way channel. Its code sends updated form data whenever a watched field changes, meaning card numbers, security codes, and OTPs can reach the fraud team before a victim presses submit.

This reflects WebSocket-driven phishing framework risks, where fake forms become live fraud consoles. A persistent WebSocket connection carries instructions between the phishing page and the criminal panel.

If it fails, the kit falls back to repeated web requests every two seconds. Traffic is wrapped in AES-256-CTR encryption, but each message contains its encryption key, mainly hiding data from casual inspection.

Operators can steer a visitor through up to 32 named pages or in-page changes. After receiving a card number, they can request an SMS code, a PIN, another card after a fake decline, or a QR verification step.

The campaign uses familiar pressure tactics. Fake toll notices, parcel charges, and delivery warnings make a small claimed debt feel urgent.

Similar brand impersonation smishing delivery tactics show why users should treat unexpected payment links as untrusted, even when a message appears polished or names a recognizable service.

A Reusable Fraud Engine

Researchers describe JWR as a reusable phishing kit rather than a fixed website. The same underlying code can sit behind different brand skins, while operators rotate short links and domains quickly.

The kit also contains markers for WordPress and Shopify integrations, expanding the risk beyond standalone phishing pages to compromised or malicious web components.

That reuse gives defenders a way to recognize future campaigns. The report highlights recurring storage keys, page names, endpoint patterns, and a distinctive WebSocket token that remain when the logo, targeted country, or hosting service changes.

Security teams can monitor for those traits, investigate unusual encrypted browser connections, and begin takedown work when matching pages appear.

For individuals, the safest response is to avoid links in unexpected texts and open the official app or type the known web address instead. Never share payment data or a code received by SMS through a text-message link.

People who submitted information should contact their bank, change reused passwords, and review recent activity without delay. The threat is also changing how lures are delivered.

Criminal groups increasingly use channels beyond ordinary SMS, as RCS and iMessage phishing expansion illustrates, to bypass filters and make messages look more credible. That makes direct verification through a trusted channel more important than judging a message by its wording alone.

Organizations should monitor new phishing pages that match the kit’s file-name signatures, watch for SMS-linked abuse of their brands, and maintain rapid reporting and takedown procedures.

Combining those measures with staff awareness and transaction checks can narrow the window in which a live operator can turn stolen details into financial loss at scale today.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Codebase family string	trsb.top	String referenced inside the JWR worker and used to identify this build line
Local storage keys	JwrCvvForm, JwrCustomCvvForm, JWRCID, JwrIpInfo, JwrSubmittedCardNumbers, JwrSelectedPaymentMethod, JwrControlInstruction, JwrExtraJSON, JwrAjaxUrl, JwrNonce, JWRIFRAMEACTIVE, jwrisThankPage, JwrIsShopify, JwrIsWordPress, JwrCustomEmailorPhone	Reused JWR client-side storage markers
Session identifier pattern	JWRCVV-[0-9]{13}-[a-z0-9]{1,13}-[a-z0-9]{1,13}	Per-victim identifier format
DOM IDs and classes	jwrGlobalErrorPopup, jwrErrorAnimationStyle, jwrErrorSlideIn, paypalLoadingdiv, paymentError1, paymentError2, paypalCardError1, paypalCardError2, loginVerifyError, codeVerifyError	Static JWR page and interface fingerprints
HTML page names	cpay.html, dsmsbank.html, ipayalselectverify.html, hpaypallogin.html	Family-distinctive phishing page set
Other observed page names	aindex.html, alogin.html, ashop.html, bpassword.html, binfo.html, bqrverify.html, dsms.html, dsmslogin.html, d2fa.html, dverify.html, dthank.html, eemail.html, fpin.html, gapp.html, gloginapp.html, hbanklogin1.html, hbanklogin2.html, hbanklogin3.html, hloading.html, ipaypalselectverify.html, jpaypalverify.html, kpaypalcard.html, lpaypalpin.html, mpaypalapp.html, zthank.html	Files used across the JWR credential-harvesting funnel
JavaScript files	main.js, ws-worker.js, check.js	Client bundle, WebSocket worker, and input-validation module
Input-ID convention	*-cardnumber, *-expiry, *-cvv, *-cardholder, *-smscode, *-emailcode, *-pincode, paypaypwd, *-paypayaccount, *-button	Input and control naming pattern used in JWR pages
URL path prefix	apiopen	Recurring JWR command-and-control endpoint prefix
C2 endpoint	apiopenaddClick	Victim-arrival beacon
C2 endpoint	apiopengetSyncSettings	Retrieves attacker-controlled configuration
C2 endpoint	apiopenaddCvv	Primary credential and card-data exfiltration endpoint
C2 endpoint	apiopenthefinalinterface	Funnel-completion notification endpoint
C2 endpoint	apiopenupdateStatus	Operator-driven status update endpoint
C2 endpoint	apiopengetPendingInstruction	HTTP long-poll endpoint for attacker instructions
C2 endpoint	apiopenbinLookup	Real-time card BIN lookup endpoint
WebSocket path	webSocketQT/JWRCID/khkjsahfjkwhakjlsdwdddddd88	Bidirectional real-time command-and-control path
WebSocket token	khkjsahfjkwhakjlsdwdddddd88	High-confidence hard-coded JWR access-token suffix
HTTP traffic pattern	Content-Type: application/octet-stream with 48-byte header and 16-byte aligned ciphertext	AES-256-CTR message envelope used by the kit
Long-poll pattern	apiopengetPendingInstruction every 2 seconds	HTTP fallback when the WebSocket channel is unavailable
Geolocation service sequence	ipinfo.io, ipapi.co, ip-api.com, httpbin.org/ip	Four-provider IP geolocation rotation
Plugin and platform markers	JwrIsShopify, JwrIsWordPress, wcgatewaycompleteorder, ?cartdata	Markers associated with Shopify and WordPress integration paths
Detection rule string	alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"JWR phishing kit: WebSocket access token in URL"; content:"webSocketQT"; http_uri; content:"khkjsahfjkwhakjlsdwdddddd88"; http_uri; classtype:trojan-activity; sid:99000001; rev:1;)	Suricata-style hunting rule for the JWR WebSocket access token
YARA rule strings	apiopenaddCvv, apiopengetPendingInstruction, webSocketQT, JWRCVV-, belongtotemplate, khkjsahfjkwhakjlsdwdddddd88, ipayalselectverify.html	JWR main bundle detection strings, with a match condition of four or more strings
Validator strings	personnummer, fodselsnummer, codicefiscale, germanid	Distinctive AutoValidator library combination
Code-level marker	WorkerCrypto.encrypt	JWR AES-CTR encryption routine using a 32-byte random key and 16-byte IV
Code-level marker	instructionConfig	Operator command map containing 32 named instructions

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC