A new SMS phishing campaign turns a routine payment check into a live fraud session. Victims who tap a link reach convincing pages seeking card details, passwords, and one-time passcodes, while criminals see information as it is entered.
The operation uses urgent messages impersonating official services and claiming a fee must be settled, a delivery confirmed, or an account verified. Shortened links redirect recipients to temporary phishing sites, where the scam can move from personal details to bank information and OTPs.
Group-IB analysts identified the JWR phishing kit and linked the activity to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem.
Group-IB said in a report shared with Cyber Security News (CSN) that the campaign combines disposable infrastructure with a live operator console, letting fraudsters adapt the page while a victim remains online.
The impact goes beyond a conventional password-stealing page. The kit can collect identity information, payment-card data, bank credentials, and verification codes, providing material for account takeover and unauthorized payments. Its rotating domains also make simple blocklists less reliable.
Smishing Hackers Can Watch Every Keystroke
The JWR kit turns a fake payment page into a two-way channel. Its code sends updated form data whenever a watched field changes, meaning card numbers, security codes, and OTPs can reach the fraud team before a victim presses submit.
This reflects WebSocket-driven phishing framework risks, where fake forms become live fraud consoles. A persistent WebSocket connection carries instructions between the phishing page and the criminal panel.
If it fails, the kit falls back to repeated web requests every two seconds. Traffic is wrapped in AES-256-CTR encryption, but each message contains its encryption key, mainly hiding data from casual inspection.
Operators can steer a visitor through up to 32 named pages or in-page changes. After receiving a card number, they can request an SMS code, a PIN, another card after a fake decline, or a QR verification step.
The campaign uses familiar pressure tactics. Fake toll notices, parcel charges, and delivery warnings make a small claimed debt feel urgent.
Similar brand impersonation smishing delivery tactics show why users should treat unexpected payment links as untrusted, even when a message appears polished or names a recognizable service.
A Reusable Fraud Engine
Researchers describe JWR as a reusable phishing kit rather than a fixed website. The same underlying code can sit behind different brand skins, while operators rotate short links and domains quickly.
The kit also contains markers for WordPress and Shopify integrations, expanding the risk beyond standalone phishing pages to compromised or malicious web components.
That reuse gives defenders a way to recognize future campaigns. The report highlights recurring storage keys, page names, endpoint patterns, and a distinctive WebSocket token that remain when the logo, targeted country, or hosting service changes.
Security teams can monitor for those traits, investigate unusual encrypted browser connections, and begin takedown work when matching pages appear.
For individuals, the safest response is to avoid links in unexpected texts and open the official app or type the known web address instead. Never share payment data or a code received by SMS through a text-message link.
People who submitted information should contact their bank, change reused passwords, and review recent activity without delay. The threat is also changing how lures are delivered.
Criminal groups increasingly use channels beyond ordinary SMS, as RCS and iMessage phishing expansion illustrates, to bypass filters and make messages look more credible. That makes direct verification through a trusted channel more important than judging a message by its wording alone.
Organizations should monitor new phishing pages that match the kit’s file-name signatures, watch for SMS-linked abuse of their brands, and maintain rapid reporting and takedown procedures.
Combining those measures with staff awareness and transaction checks can narrow the window in which a live operator can turn stolen details into financial loss at scale today.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Codebase family string | trsb.top |
String referenced inside the JWR worker and used to identify this build line |
| Local storage keys | JwrCvvForm, JwrCustomCvvForm, JWRCID, JwrIpInfo, JwrSubmittedCardNumbers, JwrSelectedPaymentMethod, JwrControlInstruction, JwrExtraJSON, JwrAjaxUrl, JwrNonce, JWRIFRAMEACTIVE, jwrisThankPage, JwrIsShopify, JwrIsWordPress, JwrCustomEmailorPhone |
Reused JWR client-side storage markers |
| Session identifier pattern | JWRCVV-[0-9]{13}-[a-z0-9]{1,13}-[a-z0-9]{1,13} |
Per-victim identifier format |
| DOM IDs and classes | jwrGlobalErrorPopup, jwrErrorAnimationStyle, jwrErrorSlideIn, paypalLoadingdiv, paymentError1, paymentError2, paypalCardError1, paypalCardError2, loginVerifyError, codeVerifyError |
Static JWR page and interface fingerprints |
| HTML page names | cpay.html, dsmsbank.html, ipayalselectverify.html, hpaypallogin.html |
Family-distinctive phishing page set |
| Other observed page names | aindex.html, alogin.html, ashop.html, bpassword.html, binfo.html, bqrverify.html, dsms.html, dsmslogin.html, d2fa.html, dverify.html, dthank.html, eemail.html, fpin.html, gapp.html, gloginapp.html, hbanklogin1.html, hbanklogin2.html, hbanklogin3.html, hloading.html, ipaypalselectverify.html, jpaypalverify.html, kpaypalcard.html, lpaypalpin.html, mpaypalapp.html, zthank.html |
Files used across the JWR credential-harvesting funnel |
| JavaScript files | main.js, ws-worker.js, check.js |
Client bundle, WebSocket worker, and input-validation module |
| Input-ID convention | *-cardnumber, *-expiry, *-cvv, *-cardholder, *-smscode, *-emailcode, *-pincode, paypaypwd, *-paypayaccount, *-button |
Input and control naming pattern used in JWR pages |
| URL path prefix | apiopen |
Recurring JWR command-and-control endpoint prefix |
| C2 endpoint | apiopenaddClick |
Victim-arrival beacon |
| C2 endpoint | apiopengetSyncSettings |
Retrieves attacker-controlled configuration |
| C2 endpoint | apiopenaddCvv |
Primary credential and card-data exfiltration endpoint |
| C2 endpoint | apiopenthefinalinterface |
Funnel-completion notification endpoint |
| C2 endpoint | apiopenupdateStatus |
Operator-driven status update endpoint |
| C2 endpoint | apiopengetPendingInstruction |
HTTP long-poll endpoint for attacker instructions |
| C2 endpoint | apiopenbinLookup |
Real-time card BIN lookup endpoint |
| WebSocket path | webSocketQT/JWRCID/khkjsahfjkwhakjlsdwdddddd88 |
Bidirectional real-time command-and-control path |
| WebSocket token | khkjsahfjkwhakjlsdwdddddd88 |
High-confidence hard-coded JWR access-token suffix |
| HTTP traffic pattern | Content-Type: application/octet-stream with 48-byte header and 16-byte aligned ciphertext |
AES-256-CTR message envelope used by the kit |
| Long-poll pattern | apiopengetPendingInstruction every 2 seconds |
HTTP fallback when the WebSocket channel is unavailable |
| Geolocation service sequence | ipinfo.io, ipapi.co, ip-api.com, httpbin.org/ip |
Four-provider IP geolocation rotation |
| Plugin and platform markers | JwrIsShopify, JwrIsWordPress, wcgatewaycompleteorder, ?cartdata |
Markers associated with Shopify and WordPress integration paths |
| Detection rule string | alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"JWR phishing kit: WebSocket access token in URL"; content:"webSocketQT"; http_uri; content:"khkjsahfjkwhakjlsdwdddddd88"; http_uri; classtype:trojan-activity; sid:99000001; rev:1;) |
Suricata-style hunting rule for the JWR WebSocket access token |
| YARA rule strings | apiopenaddCvv, apiopengetPendingInstruction, webSocketQT, JWRCVV-, belongtotemplate, khkjsahfjkwhakjlsdwdddddd88, ipayalselectverify.html |
JWR main bundle detection strings, with a match condition of four or more strings |
| Validator strings | personnummer, fodselsnummer, codicefiscale, germanid |
Distinctive AutoValidator library combination |
| Code-level marker | WorkerCrypto.encrypt |
JWR AES-CTR encryption routine using a 32-byte random key and 16-byte IV |
| Code-level marker | instructionConfig |
Operator command map containing 32 named instructions |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
The post Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs appeared first on Cyber Security News.