JWR: A Real‑Time Phishing‑as‑a‑Service Platform Hijacking Checkout Flows
Talos uncovered JWR, a live‑controlled phishing framework that mimics checkout and login pages on Shopify, PayPal, Apple and banks, streaming keystrokes and PII to operators via an AES‑CTR encrypted WebSocket. By letting attackers steer sessions in real time, it harvests full card data, IDs and 2FA codes, raising the bar for credential‑stealing campaigns.