{"id":5131,"date":"2026-04-14T11:38:13","date_gmt":"2026-04-14T11:38:13","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2026\/04\/14\/fbi-dismantles-20m-phishing-operation-w3ll\/"},"modified":"2026-04-14T11:38:13","modified_gmt":"2026-04-14T11:38:13","slug":"fbi-dismantles-20m-phishing-operation-w3ll","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2026\/04\/14\/fbi-dismantles-20m-phishing-operation-w3ll\/","title":{"rendered":"FBI Dismantles $20m Phishing Operation W3LL"},"content":{"rendered":"
\n

US and Indonesian law enforcement authorities have taken down a large-scale phishing network that has plotted over $20 million in fraud.<\/p>\n

Spearheaded by the FBI Atlanta field office, the operation targeted W3LL, a phishing kit which enables cybercriminals to impersonate legitimate login pages and trick victims into handing over their usernames and passwords. W3LL capabilities could be acquired for a fee of $500.<\/p>\n

The kit was notably sold on \u2018W3LL Store,\u2019 a members-only online marketplace, which was active between 2019 and 2023.<\/p>\n

According to Fox 5 Atlanta, investigators believe the marketplace facilitated the sale of more than 25,000 compromised accounts until its closure in 2023.<\/p>\n

The phishing operation continued after the marketplace shut down via encrypted messaging apps. Between 2023 and 2025, W3LL may have been used to target more than 17,000 victims worldwide.<\/p>\n

The FBI said it has seized the w3ll.store domain and identified its alleged developer, publicly referred to as \u2018G.L.\u2019<\/p>\n

W3LL: A Complete Phishing Ecosystem for BEC Attacks<\/strong><\/h2>\n

W3LL was first discovered in 2023 by cybersecurity firm Group-IB.<\/p>\n

In a September 2023 report, the firm\u2019s researchers claimed the threat actor behind the phishing operation had been operating since at least 2017, when it began selling the W3LL SMTP Sender \u2013 a custom tool for sending email spam.<\/p>\n

The malicious actor later started selling a phishing kit for Microsoft 365 accounts and subsequently opened the W3LL Store.<\/p>\n

At the time the report was published, Group-IB observed that that the marketplace had over 500 active users and more than 12,000 items listed for sale. Researchers estimated the W3LL Store had generated $500,000 for the actor over a 10-month period.<\/p>\n

The researchers also assessed that the W3LL phishing kit had been linked to 850 phishing sites over the same reported period.<\/p>\n

Group-IB noted that what made the W3LL Store and its products stand out from other underground markets is that the threat actor created not just a marketplace but a complex phishing ecosystem. The fully compatible custom toolset covered almost the entire kill chain of business email compromise (BEC) and could be used by cybercriminals of all technical skill levels.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

US and Indonesian law enforcement authorities have taken down a large-scale phishing network that has plotted over $20 million in fraud. Spearheaded by the FBI Atlanta field office, the operation targeted W3LL, a phishing kit which enables cybercriminals to impersonate legitimate login pages and trick victims into handing over their usernames and passwords. W3LL capabilities<\/p>\n","protected":false},"author":2,"featured_media":5132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-5131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"featured_image_urls":{"full":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"thumbnail":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1-150x150.jpg",150,150,true],"medium":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"medium_large":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"large":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"1536x1536":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"2048x2048":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"morenews-featured":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"morenews-large":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"morenews-medium":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1.jpg",300,300,false],"crawlomatic_preview_image":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5131-ea9ca8de-a994-4942-9378-9740e1ab57e1-146x146.jpg",146,146,true]},"author_info":{"display_name":"henry","author_link":"http:\/\/ft365.org\/index.php\/author\/henry\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","_links":{"self":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/5131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/comments?post=5131"}],"version-history":[{"count":0,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/5131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media\/5132"}],"wp:attachment":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media?parent=5131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/categories?post=5131"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/tags?post=5131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}