Critical Fortra GoAnywhere MFT flaw lets attackers steal credentials

Key Takeaways

• A sophisticated SMS phishing (smishing) campaign, dubbed “Smishing Triad,” is actively targeting individuals.
• The campaign leverages a custom phishing kit, “JWR,” that creates highly convincing fake payment and verification pages.
• Unlike traditional phishing, JWR employs a live operator console, allowing attackers to adapt pages in real-time and observe victim keystrokes as they enter sensitive data.
• The JWR kit can harvest personal information, payment card details, banking credentials, and one-time passcodes (OTPs).
• Defenders can identify the JWR kit through persistent technical markers despite rapidly changing domains and brand impersonations.

A new and highly interactive SMS phishing (smishing) operation is transforming routine payment verification into a dynamic fraud session, enabling attackers to monitor victims’ input in real-time. This sophisticated campaign directs unsuspecting users to meticulously crafted phishing pages designed to steal sensitive information, including credit card details, passwords, and one-time passcodes (OTPs).

The Smishing Triad’s Live Fraud Session

The campaign initiates with urgent SMS messages impersonating legitimate services. These messages typically claim an outstanding fee, a required delivery confirmation, or an account verification is necessary. Victims who click on the shortened links embedded in these texts are redirected to transient phishing websites. Here, the fraudulent activity escalates from requesting basic personal details to demanding bank information and critical OTPs.

Analysts at Group-IB have identified the underlying infrastructure as the “JWR phishing kit,” attributing its activity to a cluster of operators tracked as “Outsider” within the broader “Smishing Triad” ecosystem. According to Group-IB said in a report, this campaign distinguishes itself by combining ephemeral infrastructure with a live operator console. This innovative approach allows fraudsters to dynamically modify the phishing page while a victim is actively engaged, enhancing the scam’s adaptability and success rate. The impact extends beyond simple credential theft, encompassing identity information, payment card data, and bank credentials, all ripe for account takeover and unauthorized transactions. The rapid rotation of domains employed by the attackers also renders conventional blocklists less effective.

Smishing Hackers Can Watch Every Keystroke

The JWR kit transforms a seemingly static fake payment page into a two-way communication channel. Its integrated code transmits updated form data instantaneously whenever a monitored field changes. This means that card numbers, security codes, and OTPs can be siphoned off by the threat actors even before a victim hits the “submit” button. This capability mirrors the risks associated with WebSocket-driven phishing frameworks, where deceptive forms function as live command-and-control consoles for the fraudsters. A persistent WebSocket connection facilitates the continuous exchange of instructions between the victim’s phishing page and the criminal’s control panel.

Should the WebSocket connection fail, the kit defaults to a fallback mechanism, sending repeated web requests every two seconds. While the traffic is wrapped in AES-256-CTR encryption, each message contains its encryption key, primarily serving to obscure data from casual observation rather than providing robust security. Operators possess the ability to guide a victim through up to 32 distinct pages or in-page modifications. For instance, after acquiring a card number, they can prompt for an SMS verification code, a PIN, a different card following a simulated decline, or even a QR code verification step.

The campaign heavily relies on familiar social engineering tactics. Bogus toll notifications, parcel delivery charges, and shipping alerts are used to create a sense of urgency around a small, fabricated debt. These brand impersonation tactics underscore the critical importance for users to treat any unexpected payment links as untrustworthy, regardless of how polished the message appears or if it names a recognizable service.

A Reusable Fraud Engine

Researchers characterize JWR not as a fixed website, but as a highly reusable phishing kit. The core codebase can be easily adapted to display different brand skins, while operators can quickly cycle through shortened links and domains. Furthermore, the kit contains markers indicating potential integrations with WordPress and Shopify, suggesting the risk extends beyond standalone phishing pages to potentially compromised or malicious web components on legitimate platforms.

This reusability, however, provides a silver lining for defenders. The Group-IB report highlights consistent technical markers, including recurring storage keys, page names, endpoint patterns, and a distinctive WebSocket token. These indicators remain constant even when the targeted brand, country, or hosting service changes. Security teams can actively monitor for these specific traits, investigate unusual encrypted browser connections, and initiate takedown procedures when matching pages are detected.

What You Should Do

• For Individuals:
  • Avoid clicking on links in unexpected text messages. Instead, open the official app for the service or directly type the known web address into your browser.
  • Never provide payment card details or SMS verification codes through links received via text messages.
  • If you suspect you have submitted information, immediately contact your bank, change any reused passwords, and thoroughly review your recent account activity.
  • Be aware that threat actors are increasingly using alternative communication channels like RCS and iMessage to bypass traditional SMS filters and enhance message credibility. Always verify requests through official, trusted channels.
• For Organizations:
  • Monitor for new phishing pages exhibiting the JWR kit’s distinctive file-name signatures and technical indicators of compromise (IoCs).
  • Implement robust brand monitoring to detect SMS-linked abuse of your organization’s identity.
  • Maintain rapid reporting and takedown procedures for identified phishing sites.
  • Combine these technical measures with ongoing staff awareness training and transaction anomaly checks to minimize the window for live operators to exploit stolen details for financial gain.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.