FBI and Indonesian Authorities Dismantle W3LL Phishing Platform; Alleged Developer Arrested
Summary
U.S. and Indonesian authorities seized W3LL infrastructure and arrested its alleged developer. The platform reportedly harvested credentials and session cookies, facilitated sales of more than 25,000 accounts, and supported business email compromise fraud.
Key points
- The FBI Atlanta Field Office and Indonesian authorities seized W3LL infrastructure and arrested the alleged developer in a coordinated enforcement action.
- The W3LL phishing kit reportedly sold for $500 and created replicas of corporate login portals.
- Its adversary-in-the-middle technique intercepted credentials, MFA codes, and session cookies, which could enable account access without another MFA challenge.
- Authorities say the marketplace facilitated sales of more than 25,000 compromised accounts between 2019 and 2023.
- Investigators found the kit was used to target more than 17,000 victims worldwide between 2023 and 2024.
- The platform supported Microsoft 365-targeted business email compromise and invoice fraud, including inbox monitoring and email-rule creation.
Article Details
- Event Type
- Coordinated law-enforcement takedown of the W3LL phishing platform and arrest of its alleged developer.
- Impact
- The FBI and Indonesian authorities seized W3LL infrastructure, including w3ll[.]store. Authorities say the platform facilitated sales of more than 25,000 compromised accounts from 2019 to 2023, and the phishing kit was used to target more than 17,000 victims worldwide between 2023 and 2024. The kit captured credentials, MFA codes, and session cookies, enabling account access and business email compromise. The article also reports that users attempted more than $20 million in fraud.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | w3ll[.]store | Domain for the W3LL phishing-kit marketplace, seized by authorities in the coordinated law-enforcement operation. |
MITRE ATT&CK
T1539 · Steal Web Session CookieThe kit captured session cookies, which attackers could use to access compromised accounts without triggering MFA challenges.T1557.003 · DHCP SpoofingThe phishing kit proxied legitimate login portals through attacker infrastructure to intercept credentials and MFA codes, consistent with adversary-in-the-middle phishing.
People
Vendors
Products
Tools
Countries
Indonesiaplatform, seized its infrastructure, and arrested the alleged developer in the first coordinated U.S.–Indonesia enforcement action against a phishing kit developer.United Statesphishing platform, seized its infrastructure, and arrested the alleged developer in the first coordinated U.S.–Indonesia enforcement action against a phishing kit developer.