# Fraudulent Shopify Stores Running 'Outsider'-Linked Phishing Kits (Outsider/JWR and Playswing)

> BforeAI reports 2,000+ fraudulent Shopify storefronts impersonating legitimate brands, with roughly 100 new stores per week. A malicious theme asset (custom-checkout-redirect.js) redirects checkout to attacker-controlled phishing pages that harvest card data, PII and OTP/app approvals in real time via operator-driven kits linked to the Outsider phishing-as-a-service operation.

- **Published:** 2026-11-03T21:04:17Z
- **Last reviewed:** 2026-11-03T21:04:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5177
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5177.png
- **ID:** TL-2026-5177
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Outsider PhaaS operators (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

BforeAI (researcher Hans Dekker, published 2026-09-14) documents a large, ongoing campaign of fraudulent Shopify storefronts that impersonate legitimate brands (example: The Ordinary). Victims are lured mainly through fraudulent Google Shopping ads to the fake stores. A malicious theme asset, custom-checkout-redirect.js, intercepts the checkout flow and redirects the shopper to an attacker-controlled phishing page. The store itself never processes the payment; theft and fraud are separated, and stolen data is cashed out on separate merchants. More than 2,000 live stores were observed, with about 100 new stores per week and no ceiling reached at the time of publication. BforeAI's predictive model forecasts a surge around GTA 6 pre-release and release announcements.

Two kit families are involved. Kit 1 is the Outsider/JWR kit: the redirect script contains the markers JwrIsShopify and getSyncSettings and loads a_index.html from attacker servers. A human operator watches the victim over WebSocket and can push verification screens (SMS, email, PIN, bank-app approval). The kit targets card data, PayPal, Apple ID, Klarna, Afterpay and Amex, and relays the victim's own OTP or app approval to defeat 3-D Secure and similar controls. C2 domains named in the report are shopus.it.com, myshop-fly.it.com, us-shopnow.com, myshopusa.shop and shoppayying.com, plus operator infrastructure at ipinfo.chenlun.workers.dev (a Cloudflare Workers host; ChenLun is the operator name Group-IB attributes to Outsider). Kit 2 is Playswing, a single-bundle web app that communicates over MQTT, with backends at webapi.playswing.net and mqtt.playswing.net and per-store pay.{store} subdomains (originally pay.playswing.net). Its admin panel was reachable with client-side code and no authentication. It exposes a multi-tenant SaaS model with roles (ads, fisher), an 8-stage store lifecycle from unregistered to deleted, card management with bank/tier routing and 3DS flags, Google Ads integration with virtual card platforms (cvvgo, vicard), an identity module collecting SSN, name, address, LLC, EIN and uploaded documents, and anti-detect browser automation through the BitBrowser API with fingerprint spoofing. Automated card rotation occurs when declines are detected. The report's hunt notes also cite Shopify API-generated genuine order emails; this was not confirmed in the fetched report text.

Background and attribution: Cisco Talos (2026-08-13) analyzed the JWR framework, assessing with medium confidence that it is a variant of 'The Outsider'. JWR runs in a Host bridge mode and a Vue.js Content mode (44 HTML files), uses an AES-CTR encrypted WebSocket channel (JwrCrypto), streams keystrokes to C2 as the victim types, exposes 40+ operator instructions (to_card, to_sms, to_2fa, to_paypal_login, to_apple_login, to_klarna_pay, tip_change_card, to_success), and reads the cart_data URL parameter to rebuild real Shopify carts. Its C2 endpoints include api/open/addclick, getSyncSettings, the_final_interface, pollInstruction and addCvv. Talos saw it delivered by smishing in Southeast Asia and the UAE, with Simplified Chinese operator messages. Google sued the Outsider operators in June 2026 and the FBI, with Lumen and others, executed Operation Ghost Hook (part of Operation Riptide), seizing domains, a Shopify storefront and about $100,000 USDT. Group-IB reported 700+ new domains after the takedown (Infosecurity Magazine, 2026-09-03), showing affiliates retained access. Outsider was sold as a Telegram-run service (reported $88/week or $200/month, ~290 templates). BforeAI submitted a disclosure to Shopify on 2026-09-01 and received no response. Only the BforeAI report was read in full for the Shopify-specific findings; BeaconBeagle lookups could not be completed (HTTP 502), so no C2 correlation is recorded.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.008 Malvertising
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059.007 JavaScript
- T1036 Masquerading
- T1056 Input Capture
- T1111 Multi-Factor Authentication Interception
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outsider/JWR and Playswing C2 Domain or Phishing Landing Page Access via Web Proxy** (`TL-2026-5177-SPL-001`)

Detects web-proxy requests to the JWR/Outsider and Playswing infrastructure named in the BforeAI and Talos reports (shopus.it.com, myshop-fly.it.com, us-shopnow.com, myshopusa.shop, shoppayying.com, ipinfo.chenlun.workers.dev, webapi/mqtt/pay.playswing.net) and to an off-Shopify a_index.html landing page, the phishing page that custom-checkout-redirect.js loads during checkout hijack. A hit means a shopper was redirected from a fake Shopify storefront to an operator-driven card/OTP phishing kit (TL-2026-5177).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1071.001
- **Data sources:** web_proxy (index=proxy sourcetype=zscalernss-web), CommonSecurityLog (proxy CEF), sigma:proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval url_l=lower(url)
| eval uri_host=replace(url_l,"^(?:[a-z]+://)?([^/:?#]+).*$","\1")
| eval uri_path=replace(url_l,"^(?:[a-z]+://)?[^/?#]*(/[^?#]*)?.*$","\1")
| eval uri_query=if(like(url_l,"%?%"),replace(url_l,"^[^?#]*[?]([^#]*).*$","\1"),"")
| eval reason=case(match(uri_host,"(^|[.])(shopus[.]it[.]com|myshop-fly[.]it[.]com|us-shopnow[.]com|myshopusa[.]shop|shoppayying[.]com|ipinfo[.]chenlun[.]workers[.]dev|webapi[.]playswing[.]net|mqtt[.]playswing[.]net|pay[.]playswing[.]net)$"),"known_outsider_c2_domain", match(uri_path,"/a_index[.]html$") AND NOT match(uri_host,"(^|[.])(shopify[.]com|myshopify[.]com|shopifycdn[.]com)$"),"offsite_a_index_phish_page", true(),null())
| where isnotnull(reason)
| eval src=coalesce(src,"unknown"), user=coalesce(user,"unknown")
| stats count as hits dc(reason) as signals min(_time) as first_seen max(_time) as last_seen values(uri_host) as hosts values(uri_path) as paths values(reason) as reasons by src user
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let c2_domain_regex = @"(^|\.)(shopus\.it\.com|myshop-fly\.it\.com|us-shopnow\.com|myshopusa\.shop|shoppayying\.com|ipinfo\.chenlun\.workers\.dev|webapi\.playswing\.net|mqtt\.playswing\.net|pay\.playswing\.net)$";
let shopify_host_regex = @"(^|\.)(shopify\.com|myshopify\.com|shopifycdn\.com)$";
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend Url = tolower(RequestURL)
| extend UrlNorm = iff(Url contains "://", Url, strcat("http://", Url))
| extend UrlHost = tostring(parse_url(UrlNorm).Host), UrlPath = tostring(parse_url(UrlNorm).Path)
| extend Reason = case(
    UrlHost matches regex c2_domain_regex, "known_outsider_c2_domain",
    UrlPath endswith "/a_index.html" and not(UrlHost matches regex shopify_host_regex), "offsite_a_index_phish_page",
    "")
| where Reason != ""
| summarize Hits = count(), Signals = dcount(Reason), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Hosts = make_set(UrlHost, 20), Paths = make_set(UrlPath, 20), Reasons = make_set(Reason) by SourceIP, SourceUserName
```

### Sigma

```yaml
title: Outsider JWR and Playswing C2 Domain or Phishing Landing Page Access
id: a3f1c2d4-5b6e-4a78-8c90-1d2e3f4a5b61
status: experimental
description: Detects proxy requests to Outsider/JWR and Playswing infrastructure from the BforeAI and Talos reports, or to an a_index.html phishing page outside Shopify domains.
references:
  - https://bfore.ai/report/fraudulent-shopify-stores-running-outsider-linked-phishing-kits/
  - https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/
  - https://github.com/Cisco-Talos/IOCs/blob/main/2026/08/dissecting-the-jwr-phishing-framework.txt
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection_c2_domain:
    cs-host|endswith:
      - 'shopus.it.com'
      - 'myshop-fly.it.com'
      - 'us-shopnow.com'
      - 'myshopusa.shop'
      - 'shoppayying.com'
      - 'ipinfo.chenlun.workers.dev'
      - 'webapi.playswing.net'
      - 'mqtt.playswing.net'
      - 'pay.playswing.net'
  selection_phish_page:
    c-uri|endswith: '/a_index.html'
  filter_shopify:
    cs-host|endswith:
      - 'shopify.com'
      - 'myshopify.com'
      - 'shopifycdn.com'
  condition: selection_c2_domain or (selection_phish_page and not filter_shopify)
falsepositives:
  - Security researchers or brand-protection staff visiting the listed domains
  - Threat-intel sandboxes and URL scanners fetching known IOCs
level: high

```

**Known false positives:**

- Security researchers, brand-protection teams or sandboxes deliberately browsing the listed Outsider/Playswing domains
- Legitimate sites that happen to serve a page named a_index.html outside Shopify domains

**Tuning notes:** Change index/sourcetype to match your proxy (zscalernss-web, pan:threat, bluecoat:proxysg:access:syslog) and map url/src/user to CIM. Allow-list security-team and sandbox source IPs. Refresh the domain list as Outsider affiliates rotate infrastructure (Group-IB reported 700+ new domains after the June 2026 takedown) and pair with a DNS-block action on first hit.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious Shopify Theme Asset [indicator] Checkout Hijack Chain (locked: unlock with TL Creds)
- JWR WebSocket Channel and ws-worker.js Keystroke Streaming Indicators (locked: unlock with TL Creds)
- Connections to Outsider Operator Infrastructure on Cloudflare Workers (chenlun.workers.dev) (locked: unlock with TL Creds)
- JWR cart_data Lure URL Handoff to Non-Shopify Phishing Host (locked: unlock with TL Creds)
- Playswing Backend API and Payment Phishing Host Access (webapi/[indicator]) (locked: unlock with TL Creds)
- Playswing MQTT Broker and MQTT-over-WebSocket C2 Channel (locked: unlock with TL Creds)
- JWR Operator-Relay and Exfiltration API Paths (pollInstruction, addCvv, the_final_interface) (locked: unlock with TL Creds)
- Endpoint DNS Resolution of Outsider/JWR and Playswing Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- Domain: `shopus[.]it[.]com`
- Domain: `myshop-fly[.]it[.]com`
- Domain: `us-shopnow[.]com`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fraudulent Shopify stores running 'Outsider'-linked phishing kits (BforeAI)](https://bfore.ai/report/fraudulent-shopify-stores-running-outsider-linked-phishing-kits/)
- [Dissecting the JWR phishing framework (Cisco Talos)](https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/)
- [Cisco Talos IOCs: dissecting the JWR phishing framework](https://github.com/Cisco-Talos/IOCs/blob/main/2026/08/dissecting-the-jwr-phishing-framework.txt)
- [Google sues Chinese smishing network (The Hacker News)](https://thehackernews.com/2026/06/google-sues-chinese-smishing-network.html)
- [Outsider Phishing Kit Survives Takedown With 700 New Pages (Infosecurity Magazine)](https://infosecurity-magazine.com/news/outsider-phishing-kit-survives)
- [Hackers impersonate PayPal and Apple with new real-time phishing kit (Cybernews)](https://cybernews.com/news/cisco-talos-paypal-apple-phishing-kit-jwr/)
- [Outsider cybercrime network takedown (CyberScoop)](https://cyberscoop.com/outsider-cybercrime-network-takedown-china-fbi-google-lumen/)
- [FBI and Google dismantle Chinese phishing service that coached buyers to generate scam sites with Gemini (Tom's Hardware)](https://www.tomshardware.com/tech-industry/cyber-security/fbi-and-google-dismantle-chinese-phishing-service-that-coached-buyers-to-generate-scam-sites-with-gemini)
- [urlscan.io result: JWR example store](https://urlscan.io/result/01a01bce-bf70-75f9-860f-e03cd038c3bb/)
- [urlscan.io result: Playswing example store](https://urlscan.io/result/01a05af2-283f-75b8-a70e-5d23391662bb/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5177