Cisco Talos reported a real-world SMS phishing campaign using a framework called “JWR” that impersonates toll agencies and postal/courier services to lure victims to fake payment and login pages. Unlike basic phishing pages, the operator can actively steer the victim through fake checkout/login steps in real time and capture payment details, credentials, and one-time passcodes as the victim types them. Talos links JWR to a likely variant of “The Outsider” phishing-as-a-service operation.
The JWR campaign begins with an SMS message impersonating a toll authority or a postal/courier service, claiming an unpaid fee or a delivery issue that needs immediate action. Victims who tap the link are taken to a convincing fake checkout or login page modeled after major payment and shopping platforms. Unlike static phishing pages, JWR keeps a live connection open to the attacker, allowing them to steer each victim's session in real time and adapt the flow based on what the victim enters.
The real-time, operator-driven design is what sets this campaign apart from typical smishing. Because a person is actively guiding the interaction, the kit can respond to victim behavior, ask for additional verification when needed, and request one-time passcodes exactly when the victim expects a legitimate 2FA prompt. The pretexts, unpaid tolls and delivery problems, create urgency that pushes people to act quickly rather than verify the request independently. The realism of the impersonated checkout and login pages also removes visual cues that many people rely on to judge legitimacy.
Organizations should reinforce that legitimate toll authorities, postal services, and couriers do not request one-time passcodes through a linked web page. Employees on personal mobile devices are a key exposure point since these lures rely on SMS delivery rather than corporate email filtering. Encourage staff, especially in finance, executive support, and shipping and receiving roles, to navigate directly to official sites or apps rather than clicking links in unsolicited texts. Awareness training should emphasize that a page looking realistic is not proof of legitimacy, since these kits are built specifically to imitate trusted checkout and login flows. Treating any request for an OTP or 2FA code from a text-linked site as a red flag, regardless of how convincing the surrounding page appears, is one of the most effective defenses against this style of attack.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
JWR is a phishing kit identified by Cisco Talos that impersonates toll authorities and postal or courier services via SMS to lure victims into fake checkout and login pages, capturing payment details, credentials, and one-time passcodes.
The kit supports operator-driven sessions where victim keystrokes are streamed live, allowing the attacker to request and capture SMS OTP or 2FA codes as the victim types them.
Talos found the kit also targets identity documents like passport and driver's license images, Social Security numbers, and device fingerprints, going beyond typical card-only scams.
Talos assesses with medium confidence that JWR is a variant of a phishing-as-a-service operation called "The Outsider," run by an actor referred to as Outsider Enterprise.
You get a text: “Toll notice: your payment is overdue. Pay now to avoid penalties.” Looks routine, right? Behind that link is a JWR smishing page that looks like a real toll or courier checkout, Shopify, PayPal, even Apple-style screens, while someone watches your card number and SMS OTP appear in real time. These JWR pages don’t stop at cards, they ask for passport or driver’s license photos, Social Security numbers, even extra 2FA codes to “verify” a simple toll or delivery. If a text wants payment or OTPs, don’t tap the link, open the official toll, courier, or banking app yourself and check from there.
Cisco Talos reported a real-time phishing framework called “JWR” that guides victims through fake checkout and login pages while attackers watch keystrokes live. It is being delivered through SMS messages that impersonate toll and postal authorities, and it can capture payment details, identity…
The FBI says criminals are using social engineering to take over social media accounts, steal explicit content, and sell or post it online along with victims’ personal information. Reported tactics include pretending to be a social media company representative, spamming victims with password-reset…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
