Reported by 2 outlets

Timeline

1. update from cyberpress.org

   JWR Phishing-as-a-Service Targets Banking Customers Across Four Countries

   cyberpress.org · 56d ago · August 18th, 2026

   A newly identified phishing-as-a-service (PhaaS) framework named JWR is targeting banking and payment-service customers through convincing SMS scams. Cisco Talos found that the toolkit lets fraud operators watch victims type in real time, then guide them through fake login, payment, and verification pages designed to steal cards, credentials, identity data, and one-time passcodes. The activity uses familiar smishing lures: unpaid road-toll notices, postal charges, and parcel-delivery fees. Victims who open the malicious link land on a cloned website that resembles a transport authority, courier, bank, or payment platform. Talos observed lures tied to Singapore, the UAE, and regional services operating across Southeast Asia and the Middle East. JWR PhaaS Hits Banking JWR is more dangerous than a typical phishing kit that simply collects a submitted form. Its browser-side client maintains an AES-CTR-encrypted WebSocket connection to the attacker’s command-and-control server. This gives an operator a live view of information as it is entered, including partial card numbers, passwords, and verification codes. The operator can then react before the victim submits a form. For example, after collecting a card number, the attacker can show a fake “card declined” alert and ask for a second card. If the victim supplies a valid card, the operator can move the session to an SMS OTP, email code, PIN, or banking-app approval screen. Talos said the framework contains 44 phishing pages and m

2. update from gbhackers.com

   JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking Fraud

   gbhackers.com · 56d ago · August 18th, 2026

   JWR, an undocumented phishing-as-a-service (PhaaS) framework that turns conventional credential theft into an operator-led, real-time banking and payment fraud operation. Rather than waiting for a victim to submit a form, JWR streams keystrokes to an attacker over an AES-CTR-encrypted WebSocket channel, allowing the operator to react while card numbers, passwords and one-time codes are still […] The post JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking Fraud appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .