> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Curiouser and Curiouser - URL: https://f4n6.co.uk/security-feed/curiouser-and-curiouser/ - Published: 2026-08-13T20:31:25.000Z - Updated: 2026-08-13T20:31:25.000Z - Author: Jeff Davies - Tags: #security-feed, The Outsider ## 1\. Executive summary Cisco Talos has disclosed "JWR," a previously undocumented real-time phishing-as-a-service (PhaaS) framework and likely variant of the "The Outsider" platform. JWR uses an open WebSocket connection to stream victim keystrokes live to operators, who dynamically steer victims through fake checkout and login flows impersonating payment gateways (Shopify, PayPal, Apple, Klarna, banks). Currently deployed via SMS lures impersonating regional toll and postal authorities, the framework harvests payment card data, 2FA codes, identity documents, and device fingerprints — enabling real-time MFA bypass and comprehensive identity profiles for follow-on fraud. Attribution to "The Outsider" / "Outsider Enterprise" actor is unconfirmed (no MITRE ATT&CK profile exists in verified reference data); the link rests on shared code and functional similarities identified by Talos. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | JWR's real-time MFA bypass and device-fingerprint theft can enable account takeover at financial institutions, constituting a cyber threat requiring classification under the incident taxonomy. | Clients receiving JWR-derived fraud attempts must classify the event per their DORA taxonomy and assess whether it meets the major-incident threshold for Art. 19 reporting. | | DORA Art. 17: ICT-related incident management process | Stolen session tokens and device fingerprints can bypass conditional access, requiring detection and response within the ICT-related incident management process. | Ensure SOC playbooks cover WebSocket-based real-time phishing indicators and anomalous session behaviour, not just credential-stuffing patterns. | ## 3\. Technical analysis & attack chain **Attribution caveat:** Actor "The Outsider" has no MITRE ATT&CK profile in verified reference data; attribution is unconfirmed. The link between JWR and "The Outsider" / "Outsider Enterprise" (described as a Chinese-speaking actor) is based on code and functional similarities identified by Cisco Talos — single-sourced; verify before enforcement. ### Attack chain (confirmed from Talos reporting) 1. **Initial contact — SMS lure.** Victim receives an SMS message impersonating a regional toll authority or postal service (smishing). 2. **Phishing page load.** Victim clicks a link and lands on a parent phishing webpage — a replica of a legitimate checkout or account login page. The page loads and executes the JWR client engine. 3. **Execution mode selection.** The engine checks a single global flag, `window.__HOST_MODE`, set by the parent phishing page: - **Host Mode (flag set):** Control passes to the Host Bridge module — an immediately invoked function expression (IIFE) operating within the parent page. It establishes a persistent WebSocket connection to the C2 server, manages victim session identity, deduplicates incoming instructions, and proxies all communication between the server and a child iframe containing the actual phishing form. - **Content Mode (flag not set):** Control passes to the Vue.js Application — an interactive front end that renders phishing pages, collects victim input, manages flow across 44 HTML files, handles actor instructions, and ultimately redirects to a custom error page after exfiltrating data to C2. 4. **C2 channel establishment.** A background worker module maintains the WebSocket connection independently of page navigation for the remainder of the session, keeping the channel alive across page transitions. 5. **Live keystroke streaming.** The script continuously streams the victim's keystrokes to the C2 server as captured data in real time. 6. **Operator-driven instruction loop.** The actor sends instructions from the C2 console. Each incoming instruction is checked against a brief execution history to prevent duplicate execution, then routed by the Instruction Handling module to one of two outcomes: (a) redirect the victim to a different phishing page, or (b) update the current page's state and displayed status, awaiting the next instruction. This loop repeats until the actor closes the session. 7. **MFA bypass.** Because the session is operator-driven in real time, the actor prompts the victim for 2FA codes at the precise moment needed, then immediately relays or captures the code — defeating time-based MFA. 8. **Data exfiltration.** Data is structured in a `cvvform` object containing: credit card number, CVV, PIN, expiry date, SSN, passport/ID images, 2FA codes, website logins, PayPal credentials, and device fingerprint. Exfiltration uses either: - Plaintext JSON with the `DEV_MODE` flag set, or - The `JwrCrypto` module, which encrypts data with a newly generated key using AES-CTR before transmission. 9. **Session termination.** When the actor closes the session, accumulated data is transmitted to C2 one final time, and the victim is redirected to a custom error page. ### Technical specifics - **Impersonated brands/payment gateways:** Shopify, PayPal, Apple, Klarna, and banks. - **Client architecture:** Host Bridge module (IIFE, parent page) + Vue.js victim application (44 phishing pages, 40+ distinct C2 instructions). - **Communication modes (Content Mode):** standalone, pluginIframe, hostIframe. - **Encryption:** AES-CTR via JwrCrypto module (when DEV\_MODE is not set). - **Data schema:** `cvvform` object (fields enumerated above). - **Lure vectors:** SMS impersonating regional toll and postal authorities. ## 4\. Mitigation & containment ### P1 — within 24 hours - Implement phishing-resistant MFA (FIDO2 hardware keys) for all customer-facing and internal financial systems. JWR's real-time 2FA interception is ineffective against hardware-key-based authentication. - Review and tighten conditional access policies: JWR harvests device fingerprints and session tokens that can bypass conditional access. Add device-trust signals that cannot be replayed from a phishing page context (e.g., managed-device attestation). - Alert SOC/SOC-as-a-service teams to the JWR behavioural pattern: WebSocket connections to unknown endpoints originating from user browsing sessions, combined with credential entry on impersonated payment pages. ### P2 — within 72 hours - Deploy user education focused on SMS-based phishing (smishing), specifically unsolicited delivery notifications and toll-fee payment messages. Advise users never to enter payment credentials or 2FA codes from links received via SMS. - Implement SMS-origin filtering where feasible for customer communications; coordinate with mobile network partners on smishing lures impersonating postal/toll authorities. - Review e-commerce and online banking login flows for integration with legitimate platforms (Shopify, PayPal, Apple, Klarna) — ensure customers can distinguish authentic communications from JWR lures. ### P3 — within 7 days - Update email/SMS security gateway rules to flag and block messages containing toll-fee and postal-delivery lures with payment links. - Conduct a retrospective review of recent authentication events for anomalies: successful logins preceded by WebSocket connections to unknown endpoints, multiple page transitions within a single session, or credential entry patterns inconsistent with normal user behaviour. - Tabletop exercise: walk through a JWR-style real-time phishing scenario targeting online banking MFA to validate incident response playbooks and fraud-team escalation paths. ## 5\. Indicators of compromise The following file hashes are listed in the primary source (Talos Threat Source newsletter) but are NOT explicitly attributed to JWR. They appear in the newsletter alongside the JWR summary and may relate to other threats covered in the same edition. Treat as low-confidence for JWR correlation; verify before enforcement. | Type | Value | Confidence | Source | | -------- | ---------------------------------------------------------------- | -------------------------- | ---------- | | sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | Low (not confirmed as JWR) | Talos blog | | md5 | 2915b3f8b703eb744fc54c81f4a9c67f | Low (not confirmed as JWR) | Talos blog | | filename | VID001.exe | Low (not confirmed as JWR) | Talos blog | | sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | Low (not confirmed as JWR) | Talos blog | | md5 | c2efb2dcacba6d3ccc175b6ce1b7ed0a | Low (not confirmed as JWR) | Talos blog | | filename | tmp00055df5.dll | Low (not confirmed as JWR) | Talos blog | | sha256 | a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 | Low (not confirmed as JWR) | Talos blog | | md5 | 7bdbd180c081fa63ca94f9c22c457376 | Low (not confirmed as JWR) | Talos blog | | filename | d4aa3e7010220ad1b458fac17039c274\_62\_Exe.exe | Low (not confirmed as JWR) | Talos blog | | sha256 | c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 | Low (not confirmed as JWR) | Talos blog | | md5 | 9a47c4d379998ade2f8f99e23a630c06 | Low (not confirmed as JWR) | Talos blog | | filename | WCInstaller\_NonAdmin.exe | Low (not confirmed as JWR) | Talos blog | | sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | Low (not confirmed as JWR) | Talos blog | | md5 | 38de5b216c33833af710e88f7f64fc98 | Low (not confirmed as JWR) | Talos blog | | filename | SECOH-QAD.exe | Low (not confirmed as JWR) | Talos blog | ```iocs sha256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 md5 2915b3f8b703eb744fc54c81f4a9c67f filename VID001.exe sha256 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 md5 c2efb2dcacba6d3ccc175b6ce1b7ed0a filename tmp00055df5.dll sha256 a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 md5 7bdbd180c081fa63ca94f9c22c457376 filename d4aa3e7010220ad1b458fac17039c274_62_Exe.exe sha256 c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 md5 9a47c4d379998ade2f8f99e23a630c06 filename WCInstaller_NonAdmin.exe sha256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f md5 38de5b216c33833af710e88f7f64fc98 filename SECOH-QAD.exe ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | ----------------------------------------------- | | Persistent WebSocket connection to unknown endpoint during browsing session | Network proxy / egress firewall logs | High (corroborated by Talos technical analysis) | | Real-time keystroke streaming pattern (rapid sequential POST/WS frames containing partial credential data) | WAF / reverse proxy logs, network DLP | High (corroborated) | | Multiple rapid page transitions across 44 distinct phishing HTML files within a single session | Web proxy logs, browser telemetry | Medium (single-sourced to Talos) | | window.\_\_HOST\_MODE global flag set in page JavaScript | Client-side endpoint detection, browser extension telemetry | Medium (single-sourced) | | cvvform JSON object in outbound traffic containing CC number, CVV, PIN, SSN, 2FA codes, ID images | Network DLP, egress inspection | Medium (single-sourced) | | DEV\_MODE flag present in plaintext JSON exfiltration traffic | Network DLP | Medium (single-sourced) | ## 6\. Detection ```yara rule JWR_Phishing_Framework_Client_Engine { meta: author = "Adverse Trace" date = "2026-08-13" reference = "https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/" description = "Detects JWR real-time phishing framework client engine based on code-level artefacts" strings: $host_mode = "window.__HOST_MODE" ascii $cvvform = "cvvform" ascii $jwrcrypto = "JwrCrypto" ascii $dev_mode = "DEV_MODE" ascii $host_bridge = "Host Bridge" ascii $plugin_iframe = "pluginIframe" ascii $host_iframe = "hostIframe" ascii condition: 3 of them } ``` ```yaml title: JWR Phishing Framework WebSocket C2 Channel id: 7a3c1f2e-8b4d-4a6e-9c1f-2d5e8a7b3c6f status: experimental description: Detects persistent WebSocket connections consistent with JWR real-time phishing framework C2 channel author: Adverse Trace date: 2026/08/13 references: - https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/ logsource: category: network_connection product: proxy detection: selection: event_type: network_connection protocol: websocket initiated_by: browser filter_legitimate: destination_domain|endswith: - '.shopify.com' - '.paypal.com' - '.apple.com' - '.klarna.com' condition: selection and not filter_legitimate falsepositives: - Legitimate WebSocket connections to non-blocklisted domains - Customer service chat widgets using WebSocket level: medium ``` ## 7\. Sources - Cisco Talos, "Curiouser and Curiouser" (Threat Source newsletter), https://blog.talosintelligence.com/curiouser-and-curiouser/, 2026-08-13 - Cisco Talos, "Dissecting the JWR phishing framework", https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/, 2026-08-13 ## 8\. Adverse Trace position JWR represents a significant escalation in real-time PhaaS capability: the operator-in-the-loop model defeats time-based MFA by design, and the `cvvform` data schema captures a full identity-theft kit in a single session. For EMEA financial services, the primary risk is not the phishing page itself but the downstream impact — stolen device fingerprints and session tokens that bypass conditional access, and comprehensive PII/payment data enabling account takeover and synthetic-identity fraud. Attribution to "The Outsider" / "Outsider Enterprise" is unconfirmed (no MITRE profile; single-sourced to Talos code-similarity analysis). The file hashes in the source newsletter are not explicitly linked to JWR and should not be used as primary JWR indicators without further corroboration. We are treating this as a high-priority threat to online banking and payment-platform customers and will update this advisory if C2 infrastructure, additional IOCs, or confirmed attribution emerges. Clients should prioritise FIDO2 deployment and SOC playbook updates for WebSocket-based exfiltration patterns. --- [Read the original source →](https://blog.talosintelligence.com/curiouser-and-curiouser/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*