A previously undocumented framework streams keystrokes to a human operator as they are typed, letting the attacker redirect the victim mid-session.

 

What happened

Researchers have documented JWR, a previously unrecorded phishing-as-a-service framework that converts ordinary credential theft into a live fraud operation run by a human operator, GBHackers reported on August 18, 2026. Rather than waiting for a victim to submit a form, the kit streams keystrokes to the attacker over an encrypted WebSocket connection, meaning a persistent two-way channel between browser and server, so the operator can react while card numbers, passwords, and one-time codes are still being typed. What it collects reaches well past payment cards, covering account credentials, PINs, codes delivered by text message, two-factor authentication codes, images of passports and driver's licenses, addresses, device fingerprints, and location data. Delivery has relied on text message and email lures built around unpaid tolls, road pricing fines, parcel delivery fees, and courier notifications.

 

Going deeper

Session persistence is what makes this different from a normal credential-stealing page. Each victim gets a unique session ID, while a background process keeps the connection open as they move between pages. This allows the attacker to follow the victim through several steps, such as a checkout or bank verification process, without losing the session after each redirect. The phishing kit contains 44 different pages for collecting information such as card details, passwords, bank logins, app approvals, QR codes, one-time codes sent by email or SMS, and PINs. More than 40 remote commands let the attacker control which page the victim sees next. For example, if the attacker doesn't want to use a particular card, they can show a fake "payment declined" message and get the victim to enter another one. The stolen information is also encrypted before being sent to the attacker, making it harder for network security tools to spot the captured data.

 

What was said

Researchers assessed with medium confidence that JWR is a variant of a platform tracked as The Outsider, citing similarities in client-side code and functionality, in an analysis reported by GBHackers on August 18, 2026. They found no code-level overlap with the Lucid, Darcula, or Lighthouse kits, while noting that JWR follows the same type of pattern of live operator control, templates covering multiple brands, and interception of one-time codes.

 

In the know

The kit is designed to keep working even if its main connection is blocked. If the persistent WebSocket connection is stopped, it switches to normal web connections to track victims, receive instructions, control the phishing pages, and send stolen information back to the attacker, giving them another way to control the session when network security blocks the first one, according to the analysis. These backup connections also provide useful signs for defenders, such as requests to unusual web addresses or long-lasting WebSocket connections after someone visits a link from a text message. Newly registered or low-reputation domains using the same WebSocket structure can also be a warning sign. The phishing templates are designed to look like checkout and login pages for services such as Shopify, PayPal, Apple, Klarna, and various banks.

 

The big picture

Real-time interception is what makes this relevant since a code delivered by text, email or authenticator app is only useful to an attacker within its validity window, and an operator watching the victim type has that window. Healthcare organizations that rely on text message or push-based multi-factor authentication for staff logins and patient portal access are protected against stolen passwords but not against this. The Cybersecurity and Infrastructure Security Agency recommends phishing-resistant multi-factor authentication such as FIDO2 security keys and passkeys precisely because one-time codes and push approvals can be relayed by an attacker positioned between the user and the real service. Patient-facing payment and billing portals deserve separate attention in that review, since they carry the payment-flow characteristics these kits are built around while usually receiving less security scrutiny than clinical systems.

 

FAQs

How does a live operator change what a phishing kit can do?

Automated kits capture whatever the victim submits and stop there. A human watching in real time can respond to what the victim does, request additional information, produce plausible error messages, and escalate toward higher-value targets such as bank approval flows once initial credentials prove valid.

 

Why does encrypting the stolen data matter to defenders?

Network monitoring often identifies phishing by spotting recognizable form field names or credential-shaped values moving outbound. Encrypting that traffic before transmission removes those patterns, shifting detection toward connection behavior, destination reputation, and endpoint indicators rather than content inspection.

 

Does an authenticator app protect against this technique?

Not reliably. App-generated codes and push approvals are both relayed by an attacker sitting between the user and the genuine service, since the user completes a real authentication that the attacker forwards. Only methods binding authentication to the legitimate site's address, such as security keys and passkeys, fail on a lookalike page.

 

What is a fake decline message and why is it effective?

The operator displays a message stating the payment was rejected, which is an ordinary experience during online checkout, prompting the victim to try another card. The victim interprets a routine failure rather than an attack and volunteers additional payment details without prompting.

 

Should healthcare organizations monitor for WebSocket connections?

Monitoring every such connection is impractical since many legitimate applications use them, though alerting on long-lived connections to newly registered or unfamiliar domains is achievable. Correlating those with visits originating from text message links narrows the field considerably.