Tool
W3LL
- First Reported
- Apr 13, 2026
- Latest Reported
- Apr 16, 2026
Reported Context (5)
- in nginx-ui enabling full Nginx server takeover, a coordinated FBI–Indonesian police takedown of the W3LL phishing platform, emergence of the Storm infostealer, Android banking trojans targeting Indonesian users, Indonesia Faces Active nginx-ui Exploitation, W3LL Takedown and Emerging Malware Threats
- The FBI Atlanta Field Office and Indonesian authorities dismantled the W3LL global phishing platform, seized its infrastructure, and arrested the alleged developer in the first coordinated U.S.–Indonesia enforcement FBI and Indonesian Authorities Dismantle W3LL Phishing Platform; Alleged Developer Arrested
- The FBI and Indonesian National Police dismantled the W3LL phishing infrastructure, seized key domains, and detained alleged developer G.L after the kit was used to steal thousands of credentials and attempt more than FBI and Indonesian Police Dismantle W3LL Phishing Network Linked to $20M in Fraud Attempts
- Law enforcement, including the FBI and Indonesian police, dismantled the W3LL phishing platform, seized infrastructure and domains, and arrested the alleged developer. FBI and Indonesian Police Disrupt W3LL Phishing Platform
- International law enforcement, led by the FBI Atlanta Field Office and Indonesian police, dismantled the W3LL phishing infrastructure that enabled credential theft and attempted fraud exceeding $20 million. Authorities Dismantle W3LL Phishing Infrastructure and Detain Suspected Developer
CVE (1)
Malware (1)
People (2)
Threat Actors (2)
MITRE ATT&CK (6)
Vendors (2)
Products (5)
Tools (3)
Industries (5)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.
