#ParsedReport #CompletenessHigh
14-09-2026

Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit

https://www.group-ib.com/blog/smishing-triad-outsider-jwr/

Report completeness: High

Actors/Campaigns:
Smishing_triad (motivation: cyber_criminal)
Outsider_enterprise

Threats:
Jwr_tool
Smishing_technique
Spear-phishing_technique

Victims:
Official entities, Financial services, Banking, Brokerage, Paypal, Wordpress, Shopify, Woocommerce

Industry:
Financial, E-commerce

Geo:
Hong kong, Chinese

TTPs:
Tactics: 6
Technics: 12

IOCs:
File: 43

Soft:
WordPress, Telegram

Algorithms:
aes-256-ctr, aes, aes-ctr, aes-256

Functions:
getSyncSettings, created, mounted, getIPInfo, setInterval, synchronousDataInputHandle, closePopupWindowz, closePopupAndRedirect, initCvvForm, getDeviceInfo, have more...

Languages:
python

YARA: Found