Dissecting the JWR phishing framework

Cisco Talos has identified a sophisticated phishing framework called JWR, developed by a Chinese-speaking actor known as "Outsider Enterprise" (likely part of The Outsider PhaaS platform). JWR allows attackers to steal a vast range of sensitive data in real-time, including payment card details, login credentials, identity documents, and device fingerprints, by impersonating legitimate checkout and login pages across various payment platforms. The framework utilizes a real-time WebSocket connection to maintain control over the victim's session and stream keystrokes in near-real-time, enabling attackers to proactively determine the next action to take. The JWR kit employs a complex architecture with multiple modes (Host Bridge and Content Mode) and incorporates anti-analysis techniques to evade detection.