W3LL Phishing Platform Dismantled in Global Operation by FBI and Indonesian Police

A joint operation by the Federal Bureau of Investigation and the Indonesian National Police dismantled a global cybercrime infrastructure built around the W3LL phishing platform. The service was used to steal user credentials and facilitate fraud schemes valued at up to $20 million. Authorities also arrested the alleged developer, identified as G.L, and seized key domains tied to the operation. The FBI stated that the takedown disrupted a major resource widely used by cybercriminals to gain unauthorized access to victim accounts.

Officials emphasized that W3LL was not a conventional phishing kit, but a full-service cybercrime platform designed to support organized attacks at scale. According to Marlo Graham, Special Agent in Charge of FBI Atlanta, the platform functioned as a complete ecosystem, offering tools and infrastructure that enabled threat actors to operate more efficiently rather than relying on isolated toolkits.

Technically, W3LL operated by mimicking legitimate login pages — particularly targeting Microsoft 365 — to deceive victims and harvest credentials. However, its strength lay in its integrated services, including custom phishing kits, targeted email lists, and access to compromised servers, all sold for around $500. First detected on September 6, 2023, by Group-IB, the infrastructure targeted more than 56,000 corporate accounts between October 2022 and July 2023, successfully compromising at least 8,000. The campaign primarily affected users across the United States, the United Kingdom, Australia, Germany, Canada, France, the Netherlands, Switzerland, and Italy, generating an estimated $500,000 in illicit profits.

For the full analysis and complete breakdown, read the original article here:

https://www.ethicalhackingindonesia.com/2026/04/fbi-polri-bongkar-w3ll-platform-phishing-global-microsoft-365.html