FBI and Indonesian Police Dismantle W3LL Phishing Network Linked to $20M in Fraud Attempts
Summary
The FBI and Indonesian National Police dismantled W3LL phishing infrastructure, seized key domains and detained its alleged developer. The operation reportedly targeted more than 17,000 victims in 2023–2024 and was linked to over $20 million in attempted fraud.
Key points
- The FBI and Indonesian National Police dismantled infrastructure associated with the W3LL phishing operation and seized key domains.
- Authorities detained G.L., identified as the alleged developer.
- The W3LL kit mimicked legitimate login pages to steal credentials and reportedly cost about $500.
- W3LL used adversary-in-the-middle techniques to hijack Microsoft 365 session cookies and bypass multi-factor authentication.
- The FBI said the kit was used to target more than 17,000 people worldwide in 2023–2024.
- More than 25,000 compromised accounts were estimated to have been sold through the W3LL Store from 2019 to 2023; the storefront reportedly served about 500 threat actors.
Article Details
- Event Type
- Law-enforcement takedown of the W3LL phishing infrastructure and detention of its alleged developer.
- Impact
- The W3LL operation was used to steal credentials, hijack Microsoft 365 sessions, and bypass multi-factor authentication. Authorities said the kit was used to target more than 17,000 victims from 2023 to 2024 and attempt over $20 million in fraud; the W3LL Store also facilitated sales of more than 25,000 compromised accounts.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing kit used bogus login pages to capture credentials through web portals.T1539 · Steal Web Session CookieW3LL was reported to hijack session cookies to take over accounts.T1557 · Adversary-in-the-MiddleThe article reports that W3LL used adversary-in-the-middle techniques to hijack sessions and bypass MFA.T1566 · PhishingW3LL was used to imitate legitimate login pages and trick victims into providing credentials.
People
Products
Tools
PunnySenderThe threat actor behind the illicit service is believed to have been active since 2017, previously developing bulk email spam tools like PunnySender and W3LL Sender.W3LLThe FBI and Indonesian National Police dismantled the W3LL phishing infrastructure, seized key domains, and detained alleged developer G.L after the kit was used to steal thousands of credentials and attempt more thanW3LL Panelthe W3LL Store that served approximately 500 threat actors and allowed them to purchase access to the W3LL Panel phishing kit alongside other cybercrime tools for business email compromise (BEC) attacks.W3LL SenderThe threat actor behind the illicit service is believed to have been active since 2017, previously developing bulk email spam tools like PunnySender and W3LL Sender.