JWR phishing kit instruction/exfil traffic pattern (to_card/to_sms/to_2fa)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•1

This rule detects anomalous network traffic patterns characteristic of the JWR phishing framework. It identifies live, operator-driven exfiltration where an attacker issues specific instruction sequences (e.g., to_card, to_sms, to_2fa) via HTTP polling or WebSockets to facilitate the character-by-character capture of sensitive information like payment card details and OTPs from a victim.