Fraudulent Shopify Stores Running 'Outsider'-Linked Phishing Kits (Outsider/JWR and Playswing)

Key facts for Outsider PhaaS checkout phishing

Detection coverage for Outsider PhaaS checkout phishing

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5177 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Outsider/JWR and Playswing C2 Domain or Phishing Landing Page Access via Web Proxy

Detects web-proxy requests to the JWR/Outsider and Playswing infrastructure named in the BforeAI and Talos reports (shopus.it.com, myshop-fly.it.com, us-shopnow.com, myshopusa.shop, shoppayying.com, ipinfo.chenlun.workers.dev, webapi/mqtt/pay.playswing.net) and to an off-Shopify a_index.html landing page, the phishing page that custom-checkout-redirect.js loads during checkout hijack. A hit means a shopper was redirected from a fake Shopify storefront to an operator-driven card/OTP phishing kit (TL-2026-5177).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1071.001
• Data sources: web_proxy (index=proxy sourcetype=zscalernss-web), CommonSecurityLog (proxy CEF), sigma:proxy
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval url_l=lower(url)
| eval uri_host=replace(url_l,"^(?:[a-z]+://)?([^/:?#]+).*$","\1")
| eval uri_path=replace(url_l,"^(?:[a-z]+://)?[^/?#]*(/[^?#]*)?.*$","\1")
| eval uri_query=if(like(url_l,"%?%"),replace(url_l,"^[^?#]*[?]([^#]*).*$","\1"),"")
| eval reason=case(match(uri_host,"(^|[.])(shopus[.]it[.]com|myshop-fly[.]it[.]com|us-shopnow[.]com|myshopusa[.]shop|shoppayying[.]com|ipinfo[.]chenlun[.]workers[.]dev|webapi[.]playswing[.]net|mqtt[.]playswing[.]net|pay[.]playswing[.]net)$"),"known_outsider_c2_domain", match(uri_path,"/a_index[.]html$") AND NOT match(uri_host,"(^|[.])(shopify[.]com|myshopify[.]com|shopifycdn[.]com)$"),"offsite_a_index_phish_page", true(),null())
| where isnotnull(reason)
| eval src=coalesce(src,"unknown"), user=coalesce(user,"unknown")
| stats count as hits dc(reason) as signals min(_time) as first_seen max(_time) as last_seen values(uri_host) as hosts values(uri_path) as paths values(reason) as reasons by src user
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let c2_domain_regex = @"(^|\.)(shopus\.it\.com|myshop-fly\.it\.com|us-shopnow\.com|myshopusa\.shop|shoppayying\.com|ipinfo\.chenlun\.workers\.dev|webapi\.playswing\.net|mqtt\.playswing\.net|pay\.playswing\.net)$";
let shopify_host_regex = @"(^|\.)(shopify\.com|myshopify\.com|shopifycdn\.com)$";
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend Url = tolower(RequestURL)
| extend UrlNorm = iff(Url contains "://", Url, strcat("http://", Url))
| extend UrlHost = tostring(parse_url(UrlNorm).Host), UrlPath = tostring(parse_url(UrlNorm).Path)
| extend Reason = case(
    UrlHost matches regex c2_domain_regex, "known_outsider_c2_domain",
    UrlPath endswith "/a_index.html" and not(UrlHost matches regex shopify_host_regex), "offsite_a_index_phish_page",
    "")
| where Reason != ""
| summarize Hits = count(), Signals = dcount(Reason), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Hosts = make_set(UrlHost, 20), Paths = make_set(UrlPath, 20), Reasons = make_set(Reason) by SourceIP, SourceUserName

Sigma

title: Outsider JWR and Playswing C2 Domain or Phishing Landing Page Access
id: a3f1c2d4-5b6e-4a78-8c90-1d2e3f4a5b61
status: experimental
description: Detects proxy requests to Outsider/JWR and Playswing infrastructure from the BforeAI and Talos reports, or to an a_index.html phishing page outside Shopify domains.
references:
  - https://bfore.ai/report/fraudulent-shopify-stores-running-outsider-linked-phishing-kits/
  - https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/
  - https://github.com/Cisco-Talos/IOCs/blob/main/2026/08/dissecting-the-jwr-phishing-framework.txt
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection_c2_domain:
    cs-host|endswith:
      - 'shopus.it.com'
      - 'myshop-fly.it.com'
      - 'us-shopnow.com'
      - 'myshopusa.shop'
      - 'shoppayying.com'
      - 'ipinfo.chenlun.workers.dev'
      - 'webapi.playswing.net'
      - 'mqtt.playswing.net'
      - 'pay.playswing.net'
  selection_phish_page:
    c-uri|endswith: '/a_index.html'
  filter_shopify:
    cs-host|endswith:
      - 'shopify.com'
      - 'myshopify.com'
      - 'shopifycdn.com'
  condition: selection_c2_domain or (selection_phish_page and not filter_shopify)
falsepositives:
  - Security researchers or brand-protection staff visiting the listed domains
  - Threat-intel sandboxes and URL scanners fetching known IOCs
level: high

Known false positives:

• Security researchers, brand-protection teams or sandboxes deliberately browsing the listed Outsider/Playswing domains
• Legitimate sites that happen to serve a page named a_index.html outside Shopify domains

Tuning notes: Change index/sourcetype to match your proxy (zscalernss-web, pan:threat, bluecoat:proxysg:access:syslog) and map url/src/user to CIM. Allow-list security-team and sandbox source IPs. Refresh the domain list as Outsider affiliates rotate infrastructure (Group-IB reported 700+ new domains after the June 2026 takedown) and pair with a DNS-block action on first hit.

• 🔒 Malicious Shopify Theme Asset [indicator] Checkout Hijack Chain · unlock with TL Creds
• 🔒 JWR WebSocket Channel and ws-worker.js Keystroke Streaming Indicators · unlock with TL Creds
• 🔒 Connections to Outsider Operator Infrastructure on Cloudflare Workers (chenlun.workers.dev) · unlock with TL Creds
• 🔒 JWR cart_data Lure URL Handoff to Non-Shopify Phishing Host · unlock with TL Creds
• 🔒 Playswing Backend API and Payment Phishing Host Access (webapi/[indicator]) · unlock with TL Creds
• 🔒 Playswing MQTT Broker and MQTT-over-WebSocket C2 Channel · unlock with TL Creds
• 🔒 JWR Operator-Relay and Exfiltration API Paths (pollInstruction, addCvv, the_final_interface) · unlock with TL Creds
• 🔒 Endpoint DNS Resolution of Outsider/JWR and Playswing Infrastructure · unlock with TL Creds

Indicators of compromise for Outsider PhaaS checkout phishing

As of 2026-11-03, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5177.

Sample indicators (3 of 22)

• Domain: shopus[.]it[.]com
• Domain: myshop-fly[.]it[.]com
• Domain: us-shopnow[.]com

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How Outsider PhaaS checkout phishing works

BforeAI (researcher Hans Dekker, published 2026-09-14) documents a large, ongoing campaign of fraudulent Shopify storefronts that impersonate legitimate brands (example: The Ordinary). Victims are lured mainly through fraudulent Google Shopping ads to the fake stores. A malicious theme asset, custom-checkout-redirect.js, intercepts the checkout flow and redirects the shopper to an attacker-controlled phishing page. The store itself never processes the payment; theft and fraud are separated, and stolen data is cashed out on separate merchants. More than 2,000 live stores were observed, with about 100 new stores per week and no ceiling reached at the time of publication. BforeAI's predictive model forecasts a surge around GTA 6 pre-release and release announcements.

Two kit families are involved. Kit 1 is the Outsider/JWR kit: the redirect script contains the markers JwrIsShopify and getSyncSettings and loads a_index.html from attacker servers. A human operator watches the victim over WebSocket and can push verification screens (SMS, email, PIN, bank-app approval). The kit targets card data, PayPal, Apple ID, Klarna, Afterpay and Amex, and relays the victim's own OTP or app approval to defeat 3-D Secure and similar controls. C2 domains named in the report are shopus.it.com, myshop-fly.it.com, us-shopnow.com, myshopusa.shop and shoppayying.com, plus operator infrastructure at ipinfo.chenlun.workers.dev (a Cloudflare Workers host; ChenLun is the operator name Group-IB attributes to Outsider). Kit 2 is Playswing, a single-bundle web app that communicates over MQTT, with backends at webapi.playswing.net and mqtt.playswing.net and per-store pay.{store} subdomains (originally pay.playswing.net). Its admin panel was reachable with client-side code and no authentication. It exposes a multi-tenant SaaS model with roles (ads, fisher), an 8-stage store lifecycle from unregistered to deleted, card management with bank/tier routing and 3DS flags, Google Ads integration with virtual card platforms (cvvgo, vicard), an identity module collecting SSN, name, address, LLC, EIN and uploaded documents, and anti-detect browser automation through the BitBrowser API with fingerprint spoofing. Automated card rotation occurs when declines are detected. The report's hunt notes also cite Shopify API-generated genuine order emails; this was not confirmed in the fetched report text.

Background and attribution: Cisco Talos (2026-08-13) analyzed the JWR framework, assessing with medium confidence that it is a variant of 'The Outsider'. JWR runs in a Host bridge mode and a Vue.js Content mode (44 HTML files), uses an AES-CTR encrypted WebSocket channel (JwrCrypto), streams keystrokes to C2 as the victim types, exposes 40+ operator instructions (to_card, to_sms, to_2fa, to_paypal_login, to_apple_login, to_klarna_pay, tip_change_card, to_success), and reads the cart_data URL parameter to rebuild real Shopify carts. Its C2 endpoints include api/open/addclick, getSyncSettings, the_final_interface, pollInstruction and addCvv. Talos saw it delivered by smishing in Southeast Asia and the UAE, with Simplified Chinese operator messages. Google sued the Outsider operators in June 2026 and the FBI, with Lumen and others, executed Operation Ghost Hook (part of Operation Riptide), seizing domains, a Shopify storefront and about $100,000 USDT. Group-IB reported 700+ new domains after the takedown (Infosecurity Magazine, 2026-09-03), showing affiliates retained access. Outsider was sold as a Telegram-run service (reported $88/week or $200/month, ~290 templates). BforeAI submitted a disclosure to Shopify on 2026-09-01 and received no response. Only the BforeAI report was read in full for the Shopify-specific findings; BeaconBeagle lookups could not be completed (HTTP 502), so no C2 correlation is recorded.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading

Credential Access

T1056 Input Capture; T1111 Multi-Factor Authentication Interception

Execution

T1059.007 JavaScript; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583 Acquire Infrastructure; T1583.008 Malvertising

Reconnaissance

T1598.003 Spearphishing Link

Impact

T1657 Financial Theft

Remediation for Outsider PhaaS checkout phishing

Immediate actions

• Block the listed JWR and Playswing domains at DNS and proxy layers
• Detect custom-checkout-redirect.js containing the markers JwrIsShopify or getSyncSettings, and redirects to a_index.html
• Report spoofed-brand Google Shopping ads and fake Shopify storefronts to Google, Shopify and the impersonated brand
• Request takedowns of C2 and phishing infrastructure from registrars and hosting providers

Workarounds

• Verify the store's domain and contact the brand directly before purchasing from ad-sourced stores
• Use ClamAV signature Js.Phishing.JwrFramework-10060456-0 and Snort SIDs 66924-66928 (Cisco Talos) for JWR client detection

Longer-term hardening

• Brands: monitor for lookalike Shopify stores and brand-impersonating ads
• Issuers and merchants: move to bank-app transaction-detail approvals that show amount and merchant, since OTP relay defeats plain OTP/3DS
• Alert customers when credentials or cards appear in breach or fraud feeds

Affected and fixed versions

• Shopify — Shopify storefronts and theme assets (abused platform, not a software vulnerability)
• Consumers and payment providers — Online shoppers; card, PayPal, Apple ID, Klarna, Afterpay and Amex users

Timeline of Outsider PhaaS checkout phishing

• 2025-11-01 Approximate start of the Nov 2025 - Apr 2026 window in which Google counted 1.59M+ Outsider-generated fraudulent URLs and ~9,000 fake sites
• 2026-05-18 Start of the two-week window (May 18 - Jun 1) in which Google observed ~55,000 locked-ioc-17 spam texts
• 2026-06-12 Google sues the locked-ioc-17 operators in federal court; FBI Operation Ghost Hook seizes domains, a locked-ioc-18 storefront and ~$100,000 USDT
• 2026-08-13 Cisco Talos publishes analysis of the locked-ioc-22 phishing framework, assessed with medium confidence as an locked-ioc-17 variant
• 2026-09-01 BforeAI submits a disclosure to locked-ioc-18; no response received
• 2026-09-03 Group-IB reports 700+ new locked-ioc-17 domains after the takedown, showing operations continued
• 2026-09-14 BforeAI publishes the report on 2,000+ fraudulent locked-ioc-18 stores with ~100 new stores per week

Sources cited for Outsider PhaaS checkout phishing

• Fraudulent Shopify stores running 'Outsider'-linked phishing kits (BforeAI) bfore.ai · Research · 2026-09-14
• Dissecting the JWR phishing framework (Cisco Talos) Cisco Talos · Research · 2026-08-13
• urlscan.io result: JWR example store urlscan.io · Research · 2026-09-14
• urlscan.io result: Playswing example store urlscan.io · Research · 2026-09-14
• Cisco Talos IOCs: dissecting the JWR phishing framework GitHub · Code repository · 2026-08-13
• Google sues Chinese smishing network (The Hacker News) The Hacker News · News · 2026-06-12
• Outsider Phishing Kit Survives Takedown With 700 New Pages (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-09-03
• Hackers impersonate PayPal and Apple with new real-time phishing kit (Cybernews) cybernews.com · News · 2026-08-17
• Outsider cybercrime network takedown (CyberScoop) cyberscoop.com · News · 2026-06-12
• FBI and Google dismantle Chinese phishing service that coached buyers to generate scam sites with Gemini (Tom's Hardware) tomshardware.com · News · 2026-06-12

More in phishing

• Bad Sushi: China-nexus phishing operations shift to residential proxy networks (Japan/Taiwan targeting)
• ChatGPT Plus Billing Phishing Kit Uses Rotating WordPress Sites to Steal Payment Details and OTPs
• Town of Whitsett, NC Microsoft 365 Account Compromise Used to Send Fake Payment Phishing Email
• Operation Fake KickOff: Recruiter-Impersonation AitM Phishing Abusing SaaS to Harvest Work Credentials
• Online Scam Volumes Double to Overtake Phishing (Akamai/Bolster AI data; AI-driven phishing kits and shorter attack lifespans)