- FBI, Indonesian Police Arrest Suspect Behind W3LL Phishing Kit
- Kit-Activated Spoofed Sites, Credential Theft, $20 Million Fraud Attempts
- Infrastructure and domains seized, cutting off a major cybercrime resource
The FBI has revealed that it worked with the Indonesian National Police to take down a major global phishing platform.
The bureau said it arrested an individual with the initials GL on suspicion of operating the W3LL phishing kit. The kit, costing about $500, allowed other cybercriminals to quickly and easily create spoofed websites, as well as phishing emails.
Through the combination of the two, criminals were able to steal people’s login credentials, opening the door to financial fraud, with attackers attempting to defraud victims of more than $20 million through the platform.
Article continues below
W3LL good good
“It wasn’t just phishing, it was a full-service cybercrime platform,” said Marlo Graham, special agent in charge of the FBI in Atlanta. “We will continue to work with our law enforcement partners at home and abroad, using every tool available to protect the public.”
In addition to the W3LL kit, the cybercriminal also operated an online marketplace called W3LLSTORE between 2019 and 2023, where other scammers were allowed, among other things, to buy and sell stolen login credentials.
Until its closure in 2023, the store facilitated the sale of more than 25,000 compromised accounts, the FBI said. After the shutdown, the platform changed its name and was actively marketed on encrypted messaging platforms, and targeted over 17,000 victims worldwide.
During the operation, law enforcement “identified and seized infrastructure facilitating the phishing service”, as well as “key areas linked to the operation”.
“The removal removes a major resource used by cybercriminals to gain unauthorized access to victims’ accounts,” law enforcement said.
International law enforcement agencies have been on the lookout for phishing kits for some time.
In early March 2026, Europol and Microsoft took down Tycoon 2FA, one of the world’s largest phishing platforms as a service (PhaaS). Prior to this, Europol said it removed LabHost, a phishing kit that provided infrastructure for page hosting, interactive features to interact directly with victims, and campaign presentation services, for an average monthly rate of $249.
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
