Authorities Dismantle W3LL Phishing Infrastructure and Detain Suspected Developer
Summary
Authorities say a joint FBI and Indonesian police operation dismantled W3LL phishing infrastructure, seized domains and detained its suspected developer. The service targeted corporate accounts and was linked to more than $20 million in attempted fraud.
Key points
- The FBI Atlanta Field Office and Indonesian law enforcement led an operation to disrupt the W3LL phishing ecosystem.
- The article describes W3LL as a phishing-as-a-service platform sold for about $500; Group-IB estimates roughly 500 threat actors used its tools.
- W3LLSTORE reportedly traded more than 25,000 compromised accounts between 2019 and 2023; the operation later continued through private, encrypted channels.
- W3LL used adversary-in-the-middle techniques to capture authentication tokens and bypass multi-factor authentication, targeting corporate accounts including Microsoft 365.
- The infrastructure was linked to more than 17,000 phishing attempts worldwide in 2023–2024 and over $20 million in attempted fraud, according to the article.
- Authorities seized domains and infrastructure, and Indonesian police detained the suspected developer, identified as “G.L.”
Article Details
- Event Type
- International law enforcement takedown of the W3LL phishing-as-a-service infrastructure, including domain and infrastructure seizures and detention of the suspected developer.
- Impact
- The operation disrupted infrastructure used for credential theft and business email compromise. The article reports more than 17,000 phishing attempts in 2023–2024, over 25,000 compromised accounts traded through W3LLSTORE between 2019 and 2023, and more than $20 million in attempted fraud. W3LL was used to target corporate accounts, including Microsoft 365, and its adversary-in-the-middle techniques could capture authentication tokens and bypass multi-factor authentication.
MITRE ATT&CK
Threat Actors
Products
Microsoft 365 Apps for Enterpriseecosystem including the W3LLSTORE marketplace and tools used to target corporate accounts such as Microsoft 365, and authorities seized domains and detained the suspected developer.W3LLSTOREThe takedown targeted a phishing-as-a-service ecosystem including the W3LLSTORE marketplace and tools used to target corporate accounts such as Microsoft 365, and authorities seized domains and detained the suspected
Tools
Countries
AustraliaData suggests that tens of thousands of corporate accounts were targeted globally, with a significant concentration of victims in the United States, followed by Europe and Australia.United StatesData suggests that tens of thousands of corporate accounts were targeted globally, with a significant concentration of victims in the United States, followed by Europe and Australia.
Industries
financeThe phishing kit was used in attacks targeting organizations across multiple industries, including finance, healthcare, manufacturing, and IT services.HealthcareThe phishing kit was used in attacks targeting organizations across multiple industries, including finance, healthcare, manufacturing, and IT services.IT servicesThe phishing kit was used in attacks targeting organizations across multiple industries, including finance, healthcare, manufacturing, and IT services.ManufacturingThe phishing kit was used in attacks targeting organizations across multiple industries, including finance, healthcare, manufacturing, and IT services.