JWR phishing kit real-time card/OTP/ID exfiltration via C2 REST endpoints

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects outbound network connections to known JWR phishing framework endpoints. The rule identifies suspicious interaction sequences, including initial beaconing via 'addClick' or 'getSyncSettings' followed by exfiltration of sensitive data (payment card info, OTPs) through POST requests to 'the_final_interface' or 'addCvv', or via a specific WebSocket channel pattern.