FBI and Indonesian Police Disrupt Major Phishing Operation Linked to $20M Scam

Post Views: 3

FBI and Indonesian Authorities Dismantle W3LL Phishing Kit Platform

The Federal Bureau of Investigation (FBI) and Indonesian authorities have successfully taken down the W3LL phishing kit platform, which has been used in a massive global cybercrime scheme resulting in over $20 million in attempted fraud.

Platform Description

The W3LL phishing kit is a sophisticated cybercrime ecosystem that allows users to create fake login portals mimicking legitimate websites. This enables victims who enter their credentials unknowingly hand over usernames, passwords, and session data to attackers, allowing them to bypass multi-factor authentication protections and maintain unauthorized access to compromised accounts.

Operation Details

The operation targeted the W3LL phishing kit, which is described as a “full-service cybercrime platform” by law enforcement officials.
The platform is connected to an underground marketplace called W3LLSTORE, where threat actors buy and sell stolen credentials, remote desktop access, and unauthorized entry to compromised systems.
Between 2019 and 2023, investigators estimated that more than 25,000 compromised accounts were traded through the platform.
Despite the shutdown of W3LLSTORE in 2023, the operation continued through encrypted messaging channels, with the phishing tool being rebranded and promoted to new users.
Between 2023 and 2024, the W3LL phishing kit was allegedly used in campaigns targeting more than 17,000 victims worldwide.

According to the FBI, the alleged developer behind the platform, identified as G.L., has been detained by Indonesian authorities, and key domains linked to the service have been seized.

The takedown of the W3LL phishing kit platform is seen as a significant blow to a major cybercrime resource used by threat actors to gain unauthorized access to victims’ online accounts.