Cisco Talos reported a real-world SMS phishing campaign using a framework called “JWR” that impersonates toll agencies and postal/courier services to lure victims to fake payment and login pages. Unlike basic phishing pages, the operator can actively steer the victim through fake checkout/login steps in real time and capture payment details, credentials, and one-time passcodes as the victim types them. Talos links JWR to a likely variant of “The Outsider” phishing-as-a-service operation.
The JWR campaign begins with an SMS message impersonating a toll authority or a postal/courier service, claiming an unpaid fee or a delivery issue that needs immediate action. Victims who tap the link are taken to a convincing fake checkout or login page modeled after major payment and shopping platforms. Unlike static phishing pages, JWR keeps a live connection open to the attacker, allowing them to steer each victim's session in real time and adapt the flow based on what the victim enters.
The real-time, operator-driven design is what sets this campaign apart from typical smishing. Because a person is actively guiding the interaction, the kit can respond to victim behavior, ask for additional verification when needed, and request one-time passcodes exactly when the victim expects a legitimate 2FA prompt. The pretexts, unpaid tolls and delivery problems, create urgency that pushes people to act quickly rather than verify the request independently. The realism of the impersonated checkout and login pages also removes visual cues that many people rely on to judge legitimacy.
Organizations should reinforce that legitimate toll authorities, postal services, and couriers do not request one-time passcodes through a linked web page. Employees on personal mobile devices are a key exposure point since these lures rely on SMS delivery rather than corporate email filtering. Encourage staff, especially in finance, executive support, and shipping and receiving roles, to navigate directly to official sites or apps rather than clicking links in unsolicited texts. Awareness training should emphasize that a page looking realistic is not proof of legitimacy, since these kits are built specifically to imitate trusted checkout and login flows. Treating any request for an OTP or 2FA code from a text-linked site as a red flag, regardless of how convincing the surrounding page appears, is one of the most effective defenses against this style of attack.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
JWR is a phishing kit identified by Cisco Talos that impersonates toll authorities and postal or courier services via SMS to lure victims into fake checkout and login pages, capturing payment details, credentials, and one-time passcodes.
The kit supports operator-driven sessions where victim keystrokes are streamed live, allowing the attacker to request and capture SMS OTP or 2FA codes as the victim types them.
Talos found the kit also targets identity documents like passport and driver's license images, Social Security numbers, and device fingerprints, going beyond typical card-only scams.
Talos assesses with medium confidence that JWR is a variant of a phishing-as-a-service operation called "The Outsider," run by an actor referred to as Outsider Enterprise.
You get a text: “Toll notice: your payment is overdue. Pay now to avoid penalties.” Looks routine, right? Behind that link is a JWR smishing page that looks like a real toll or courier checkout, Shopify, PayPal, even Apple-style screens, while someone watches your card number and SMS OTP appear in real time. These JWR pages don’t stop at cards, they ask for passport or driver’s license photos, Social Security numbers, even extra 2FA codes to “verify” a simple toll or delivery. If a text wants payment or OTPs, don’t tap the link, open the official toll, courier, or banking app yourself and check from there.
Cisco Talos reported a real-time phishing framework called “JWR” that guides victims through fake checkout and login pages while attackers watch keystrokes live. It is being delivered through SMS messages that impersonate toll and postal authorities, and it can capture payment details, identity…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
This weekly threat bulletin highlights multiple real-world incidents and campaigns, including phishing operations aimed at tricking people into handing over credentials. One campaign targeted Taiwanese research organizations with event-invitation emails, QR codes, and fake Google login pages…
