FBI, Indonesian Police Dismantle W3LL Phishing Operation

The Federal Bureau of Investigation, in collaboration with Indonesian National Police, has dismantled a global phishing operation known as W3LL, arresting its alleged developer and seizing key domains used to facilitate widespread cyber fraud. The takedown, announced on Monday, targeted a platform that enabled hackers to steal credentials from more than 17,000 victims worldwide between 2023 and 2024, authorities said.

The operation centered on the W3LL phishing kit, which cybercriminals could purchase for about $500 to create fake login pages mimicking legitimate services, such as Microsoft 365 accounts. These replicas tricked users into entering usernames, passwords, and multifactor authentication codes, allowing attackers to capture session tokens and bypass security measures through adversary-in-the-middle techniques. Once access was gained, criminals could monitor inboxes, set up email rules, and impersonate victims to execute business email compromise attacks, including invoice fraud and payment diversions. The FBI estimated that the kit supported attempts to perpetrate more than $20 million in fraud.

Authorities seized the domain for the W3LL Store, an online marketplace...